Riot Locks Nearly 300,000 League of Legends and VALORANT Accounts: The 'Hitchhiker' Clause Is the Real Story

In 2026, at the World Cup in the United States, FIFA changed how points were awarded: a win was worth three points instead of two. No team objected, yet the way the game was played changed from that moment on, because whoever controls the points system controls behaviour on the pitch. Thirty-one years later, Riot Games has done something of the same nature at a larger scale: nearly 300,000 League of Legends and VALORANT accounts locked for ranked cheating. The most discussable part is not the account count but the four policy lines that came with it — multi-factor authentication, TPM 2.0 hardware attestation, rank-differentiated verification requirements, and the right to claw back League Points from players labelled “hitchhikers”.

Vanguard is a kernel-level anti-cheat client. It was deployed for VALORANT first, then Riot integrated it into the League of Legends client in September 2026. That expansion turns a single-title tool into platform-level governance infrastructure: one software layer now covering two communities with different playing cultures and update rhythms.

Riot defines boosting as a highly skilled player logging into someone else’s account to climb the ladder. In its announcement, the company said it had actioned nearly 300,000 accounts across both titles and framed that as roughly 0.2% of an estimated 140 million monthly players — about 120 million for League of Legends and 20 million for VALORANT. Neither the 120 million nor the 20 million figure is attached to any source. Every quantitative claim in this story comes from one side only: the enforcing party.

Sitting next to a veteran reporter in 2026, I learned that the truth does not need a side, only someone willing to say it. Here, the person willing to say it has to be the one questioning the very denominator the publisher chose for itself.

Where the denominator is inflated

Mainland China runs League of Legends and VALORANT inside Tencent’s ecosystem, with localised anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. If the 300,000 actioned accounts exclude Chinese servers, then the 0.2% ratio is being divided by a denominator larger than the actual enforcement surface. A substantial share of League of Legends monthly actives sits beyond the reach of the 300,000 figure, which is why 0.2% should be read as a directional marker, not an audited number.

Enforcement intensity is misread because the window is missing

Vanguard entered League of Legends in September 2026. Nearly 300,000 accounts is therefore a cumulative tally over roughly one quarter, not a year. Annualised, the enforcement run-rate is far higher than the headline implies. Conversely, with no time window and no prior-period comparison, nobody can verify whether this was a peak or just a baseline.

LP becomes a better skill signal

Riot added LP-loss protection when a game contains a detected cheater or a leaver. Statistically, this compresses variance: with fewer luck-driven losses, LP reflects skill more accurately across large samples. For academies and tier-2 teams that use the ladder as a scouting filter, that is a real change — and the least discussed element of this announcement.

The “hitchhiker” and liability by association

This is the sharpest edge. A hitchhiker plays on their own account, installs no cheating software, queues alongside a boosted account, and can still lose earned ranked points. Riot is extending liability to a third party who broke no software rule. The announcement discloses no false-positive rate, no appeals process, no independent audit of the 300,000 figure. At that scale, the transparency gap is larger than reasonable.

Smurfing: a deliberately soft line

Riot states plainly that smurfing is not automatically cheating and enumerates eight legitimate use cases, including protecting one’s highest achievement on a main account. The enforcement boundary therefore rests on intent and behaviour, not on account count. That is a soft policy choice, and precisely because it is soft it will be applied inconsistently — the community will collide with it far more often than with the account locks.

TPM 2.0 and a two-tier player base

The planned addition of multi-factor authentication, TPM 2.0 hardware attestation and rank-differentiated verification creates a two-tier model inside a single community. Logically, heavier pressure at higher ranks is defensible. On fairness grounds, players on shared machines or in internet cafés are hit first, and that group is large in many regions. Binding accounts to hardware also raises the cost of creating a one-time account sharply, with a side effect: the account-resale market contracts while boosting prices rise.

The rule-maker, the enforcer and the data source are the same party

Riot writes the rules, enforces them, supplies the enforcement statistics and captures the commercial benefit of enforcement. There is no independent arbitration layer in that structure. This is inherent to publisher-run esports, but at the scale of 300,000 accounts plus an incoming hardware-verification regime, it becomes something that should be said out loud.

The contrarian angle

Based on my experience watching matches on grass and in esports arenas, every large enforcement wave follows the same template: a very loud headline and very heavy fine print. What Riot is building is not a sweep but a permanent behavioural enforcement layer — anti-cheat shifting from hunting cheat software to monitoring ladder behaviour. Once that infrastructure sits inside the client, the list of monitored behaviours can only expand, never shrink.

The biggest risk here is not the cheater. It is the innocent player pulled into a clawback with no published appeal route. In any enforcement system, the false-positive rate is a design question, not a question of the enforcer’s goodwill. That design has not been presented.

Microphone down, I understand it: pushback is not attack, it is listening to the very end before speaking. With 300,000 accounts, listening to the end means demanding three things — the false-positive rate, the appeals process, and the evidentiary standard used to classify someone as a hitchhiker.

One more point few want to raise: supply-side enforcement does not erase demand. People still want a high rank for rewards, for status, for an academy trial. Skilled players at the bottom of the pyramid still need income. Boosting prices will rise, the margins of surviving operators will fatten, and part of the activity will migrate to titles with weaker verification walls.

Takeaway

Over the next 12 months I place three verifiable bets: boosting prices rise rather than the market disappearing; Riot moves from one-off disclosure to periodic enforcement reporting; and hardware attestation appears in at least one region before 2027. If all three are wrong, I will be the first to rewrite.

I do not write to make people agree; I write so they know someone out there is thinking differently, and that is fine.

What I have said before

• 2026: the “ghost football” series — K League 1 home win rate fell from 47% to 32% with empty stands. Correct.
• 2026: predicted Italy would win the Euro final and England would play a negative 5-3-2. Italy won on penalties 3-2. Correct.
• 2026: seven statistics showing Germany’s pressing capacity down 23% versus 2026. Germany went out in the group stage. Correct.
• 2026: boosting prices rise, Riot reports periodically, hardware attestation arrives before 2027. Pending.