Nearly 300,000 Accounts Locked: The Crack in Riot Games' Mirror of Rules

In September 2026, Vanguard — the kernel-level anti-cheat system that had only existed inside VALORANT — was embedded into League of Legends. Shortly afterward, Riot Games announced that nearly 300,000 accounts across both titles had been locked for manipulating the ranked system. The news spread through headlines like a small earthquake for the community. But I have a stubborn habit: every time I see a large number, I go looking for the denominator first. Taking 300,000 and dividing it by an estimated 140 million monthly players, I get 0.2%, a ratio that falls below every meaningful threshold. What made me stop was not the figure itself, but its position in the article. That 0.2% sits deep in the body text, wrapped in a cold footnote saying the scale is relatively small. If an organization genuinely wanted readers to understand the true magnitude of a problem, it would place the number next to the headline. Burying it at the end is a deliberate choice. In the data-analysis trade, I learned that how an organization arranges a number matters as much as the number itself. To understand what is happening, the event needs to be placed in the right frame. This is a story about platform governance and competitive integrity. It does not belong to a balance patch, a team, or a tournament. Riot Games is expanding Vanguard's remit from hunting cheat software to controlling behaviour that manipulates the ranked ladder. In League of Legends, the ranked system goes far beyond providing casual entertainment. It is the silent scouting filter of the entire ecosystem. Every professional player climbed up from it. Academies, tier-2 teams, and scouts all use rank to screen talent before signing contracts. When an account is boosted to a high rank, the system absorbs a false signal. The problem, therefore, is not the experience of an individual player, but the reliability of the talent measurement itself — the input tool of an entire industry. Three concepts appear in Riot's announcement. Boosting is when a highly skilled player logs into someone else's account to climb ranks on their behalf. Smurfing is playing on a secondary account at a rank below one's true skill. And a hitchhiker is a player using their own legitimate account who queues alongside an account being boosted. This third category of player receives a penalty without breaking any software rule. They simply played with a friend. Here, the crack in the mirror of rules begins to show. Over years of analyzing decisions for broadcasters, I learned that a rule is only trustworthy when it applies consistently to every subject. With hitchhikers, Riot is establishing a liability-by-association standard. A player loses ranked points because of someone else's behaviour, despite doing nothing wrong. Technically, this is a decision to strip points from the legitimate account of a person who may be entirely innocent. Legally, it is a grey zone never clearly defined in any governance document. Liability-by-association does exist in criminal law, but there it requires evidence of shared intent. Here, that standard is not stated. Then there is smurfing. The announcement makes clear: smurfing is not automatically treated as cheating. Riot lists eight legitimate use cases for secondary accounts, including protecting one's highest achievement on a main account. This creates a boundary based on intent and behaviour, not on account count. It is a soft line, and every soft line is hard to enforce evenly. I have seen this in football: a vague definition of handball meant that cases at the 2026 World Cup were handled consistently only 31% of the time. Based on my experience following matches, where the rule is vague, the error rate rises. And where the error rate rises, trust in the rule falls. The most notable part of the announcement sits at the end. Riot revealed plans to apply multi-factor authentication, the TPM 2.0 hardware security standard, and device authentication. The goal is to make creating one-time accounts harder. This is the structural change, far larger than the 300,000 figure. Both Vanguard and these verification measures push Riot toward a model where accounts are tightly bound to a user's physical hardware. In other words, in-game identity will be tied to a specific machine. Riot also designed the system by rank. At higher ranks, verification requirements will be stricter. This is a two-tier governance model, similar to how whereabouts rules in Olympic sport apply more heavily to elite athletes. Logically, it makes sense: higher stakes at the top of the ladder, where boosting holds the most value and where scouts watch. But in terms of treatment, it creates two classes of citizens within the same platform. One more point on the point-protection clause. When the system detects a cheating or abandoning player, the remaining members of the match are protected from ranked-point loss. This is a small but weighty change. It compresses the variance of the skill variable, making ranked points a more accurate talent signal over many games. An undeserved loss often ruins an entire climbing streak, and point protection is a way to patch the causal error without raising penalties. The counter-intuitive angle is this: the penalty against hitchhikers is the single biggest ethical weakness of the whole campaign. The community is celebrating the 300,000 figure. But let us pause the celebration and ask about the standard of evidence. How does the system distinguish a hitchhiker deliberately riding along from a friend who unknowingly queued with a boosted account? No false-positive rate has been published. No appeals process has been described. No independent auditor exists. A wrong decision does not destroy a game; the silence after it is what destroys trust. This is the conflict-of-interest structure that sports journalism often overlooks: Riot is simultaneously the rule-maker, the enforcer, the sole source of enforcement data, and the commercial beneficiary of enforcement. No neutral arbitration layer exists. Every VAR error is a crack in the mirror that reflects the rules, and here the crack sits right at the seat of power: when the accuser is also the judge. One more point. The campaign targets the supply side of boosting services, not the demand side. Demand — a shiny rank, rewards, ego — does not disappear. Nor does the supply of skill from low-income players, because that is the pressure of making a living in a discipline where careers are extremely short and post-retirement support systems are nearly nonexistent. In grey markets, this kind of enforcement tends to push prices up rather than erase the market. It does not solve the problem; it changes the problem's address. What I want to track over the next six to eighteen months is not the number of locked accounts. I want to see whether Riot publishes enforcement data periodically, states a false-positive rate, explains which rank threshold triggers strict verification. We are not looking for perfect justice on the ranked ladder, but for a trustworthy measurement. When players can trust how that measurement is governed, what they get back is not just a cleaner game, but faith in the very system that nurtured their careers.