Three Hundred Thousand Accounts Locked: When Riot Games Turned Off the Ranked Ladder's Lights and No One Had Time to Say the Names

Three in the morning at a small internet cafe near the Busan harbor. Outside, September rain falls steadily like a song no one wants to hear all the way through. Inside, the mechanical keyboard clatters like a rainstorm, the mouse clicking at a steady pace like the heartbeat of someone running a marathon in the dark. I sit in the corner of the room, watching a seventeen-year-old boy's screen. He is in Diamond rank, just won a match after twenty-eight tense minutes. He does not smile. He just takes a long breath, then clicks Play Again. Three days later, when I return to that internet cafe, the boy's screen is dark. Not because of a power outage. But because of a short notification: Your account has been temporarily locked. No explanation. No duration. Just one line of text and an appeal button he does not know will actually work. That same week, Riot Games announced a figure that made the whole esports industry pause: nearly 300,000 accounts locked for fraudulent behavior in ranked play, across two titles, League of Legends and VALORANT. That is not a small number. It is a seismic event. But behind that number stand three hundred thousand names no one read aloud before pressing the lock button. This is not a story about a patch. It is a story about power. About who gets to define cheating, who gets to keep their account, and who is erased from the ranked ladder with no court of appeal. Riot Games did not publish the 300,000 figure at random. It is the cumulative result of a campaign that began in September 2026, when Vanguard - the kernel-level anti-cheat client originally deployed for VALORANT - was formally integrated into League of Legends. Before September 2026, Vanguard was a controversial name in the global League community. It operates at the kernel level, meaning it has deep access to players' systems, a privilege not every piece of software is granted. On VALORANT, Vanguard proved effective: software cheats dropped sharply, especially sophisticated aim bots and wallhacks. But when it spread to League of Legends, part of the community raised privacy and system-control concerns. This is a topic Riot never fully addressed in this announcement. No document explains how kernel-level data is processed, how long it is stored, or who has access. The 300,000 figure is not simply the number of accounts using cheat software. It covers a much broader category. First, accounts involved in the boosting market - paid services where a highly skilled player logs into someone else's account and climbs ranks on their behalf. Second, hitchhiker accounts - players using their own account, no cheats, no account sharing, but queuing alongside a boosted account. Third, accounts violating the multi-account policy at scale. According to estimates cited in the original report, League of Legends has roughly 120 million monthly players, VALORANT around 20 million. Combined, approximately 140 million monthly players across both titles. Against that 140 million, the 300,000 locked accounts represent just under 0.2%. The author of the original piece concedes this is a relatively small figure. But for the people locked out, it is not a number. It is a span of time. It is sleepless nights. It is matches they believed were bringing them closer to a better version of themselves. The most notable element of this entire event is not the number of locked accounts, but the expansion of what counts as a violation - specifically the hitchhiker doctrine Riot is now enforcing. Previously, when discussing ranked cheating, people thought of two groups: cheat-software users and boost-service buyers. Riot has now added a third: players who broke no software rule whatsoever, but queued alongside an account being boosted. They are called hitchhikers. The penalty can be the loss of all ranked points earned in affected matches, whether they won or lost by their own hands. This is the first time in years that a major game publisher has claimed the right to punish based on associative conduct, not just individual conduct. If you accidentally queue with a friend without knowing they were being boosted, you may still lose points. Riot's announcement contains no documentation about an appeal mechanism for this case. No false-positive rate. No clear definition of how to distinguish an accidental friend from a deliberate one. In League of Legends ranked culture, queuing with friends is a fundamental part of the experience. On the Korean servers I used to follow, a group of friends climbing together late at night is a collective ritual. When the punishment mechanism extends to this group, it does not only affect cheaters. It affects the entire social structure of ranked play. It turns every friend into a potential risk, every queue click into a gamble on the identity of the person sitting next to you. The second notable point is the calculated tolerance for smurfing. Smurfing - a highly skilled player creating a new account at a lower rank to start over - has long been controversial. But Riot does not regard smurfing as cheating by default. In this announcement, the publisher listed eight legitimate smurf use cases, including preserving the highest achievement on a main account, or playing with friends at a lower rank. Riot representative Phillip mirageofpenguins Koskinas addressed the issue directly. He emphasized that smurfing is not automatically a violation. This is a conscious policy choice, and it runs against the expectations of a large segment of the community - those who want Riot to crack down harder on any non-main account. This creates a large gap between player expectation and policy reality. The community wants an all-out purge. Riot chooses an intent-based line - where smurfing is permitted if it serves a legitimate purpose, while boosting is the violation. But how do you distinguish a smurf playing with a friend from someone being boosted, when both look externally identical? That is a question Riot has not answered adequately. The third point, and the one I believe is least discussed, is the plan for hardware-level identity verification. Riot revealed that in the future it will deploy multi-factor authentication (MFA) and, more importantly, TPM 2.0 - a hardware security standard enabling device-level identity attestation. The goal is to make throwaway account creation harder. Additionally, verification requirements will differ by rank - higher-ranked players will face stricter verification. If this comes to pass, it will change the economic structure of the entire account system. TPM 2.0 binds an account to a specific physical device. That means a player using a shared PC at an internet cafe, or a player in an area with limited device access, will find it harder to maintain a fully verified account. This is an accessibility equity problem Riot's announcement never mentions. In South Korea, internet cafes are not just gaming venues. They are social spaces. Many young pro players, many students, many unemployed people use internet cafes as offices, as living rooms, as home. If the future of League of Legends is one account bound to one device, that social structure is under threat. Riot has not answered this question. And perhaps they never will, because those most affected often have no voice in policy discussions. The fourth point, and the most humane one, is the LP protection mechanism when cheating or leaving is detected. According to the announcement, when a match includes a cheat account or a leaver, remaining players do not lose LP. This is a small but significant change. It alters the mathematical expectation of ranked grinding: reducing the penalty for unlucky games, making LP a slightly more accurate skill signal over large samples. For an ordinary player in Busan who stays up until 3 a.m. to climb, this may be the only piece of good news in the entire story. But it also raises a larger question: if Riot can protect LP for innocent players in poisoned matches, why can it not protect accounts for innocent players labeled hitchhikers? If it can distinguish matches affected by cheating, why can it not distinguish the accidental friend from the deliberate one? There is an implicit assumption in this entire story: that stronger enforcement will reduce cheating. That assumption may be wrong. The boosting market does not exist because of weak penalties. It exists because of demand - players want high ranks for prestige, seasonal rewards, self-validation. And it exists because of supply - highly skilled players, especially at the lower tiers of the scouting system, need income. In esports, this is an under-discussed reality: many tier-2 and tier-3 players live below a living wage, and boosting is among the most common side incomes. When you raise the cost of boosting without addressing demand and supply, the market does not disappear. It reprices. Boost prices rise. Remaining operators earn higher margins per transaction. And if League of Legends and VALORANT become too hard to cheat in, the activity migrates to titles with looser enforcement. The problem is not solved. It is displaced. This is a basic law of gray markets, and no anti-cheat software can change it. Another under-observed point: the 300,000 figure may not be a real number. It is published by Riot itself, un-audited by third parties, with no baseline comparison from prior periods, no breakdown by title or region. Meanwhile, the 140 million monthly player figure is also unsourced - a floating estimate. When both numerator and denominator come from a single party with a direct interest in the story, we should read the number as a directional signal, not a verified fact. And there is a deeper structural issue: Riot is simultaneously the rule-maker, the enforcer, the data source on enforcement, and the commercial beneficiary of enforcement. There is no independent arbitration layer. In football, when FIFA issues sanctions, there is at least a Court of Arbitration for Sport. In League of Legends, players can only appeal to Riot itself. This is not an accusation that Riot did wrong. It is a structural observation. When a publisher holds the entire control chain - patch, tournament, client, hardware attestation - the space for independent oversight narrows to almost nothing. And when power concentrates like that, even correct decisions need third-party audit. Without that mechanism, we can only trust. And trust, in this industry, is a scarce commodity. Another dimension to mention: the impact on talent scouting. The ranked ladder is not just where players have fun. It is the implicit selection system of the entire esports industry. Academies, tier-2 teams, and scouts use rank as their first filter. If boosting pollutes that signal, scouting quality drops. But if enforcement is too strong and too blind, it can also eliminate genuine talents trying to climb on their own merit. This is a trade-off Riot has not quantified, and likely never will. One more issue: the Chinese servers. League of Legends and VALORANT in mainland China are operated within Tencent's ecosystem, with anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. Whether the 300,000 figure includes, excludes, or is separable from the Chinese server population is unresolved in the source material. If the enforcement figure is global-ex-China, then the effective coverage rate against the 140 million player base is overstated, since a large share of League's monthly actives sit in the China ecosystem. This is a potential denominator error in the original report's 0.2% calculation. Looking back at the whole story, I realize one thing: we live in an era where the digital identities of hundreds of millions of people are defined by a handful of private companies. In Busan, a seventeen-year-old boy just lost his account to an algorithm he does not understand. He does not know what he violated. He does not know where to appeal. He only knows that tomorrow, when he goes to the internet cafe, he will start over from zero. Three hundred thousand accounts is not a number. It is three hundred thousand names no one read aloud before pressing the lock button. It is three hundred thousand times someone sat before a screen believing they were moving forward, then suddenly realized they were standing still. Three hundred thousand locked accounts is a large figure. But it is only the starting point of a much larger story: the story of a private company gradually seizing the right to define the identities of hundreds of millions of players. In the future, when your League account is bound to hardware, when high rank demands stricter verification, when playing with a friend can cost you points - the question will no longer be who is cheating, but who holds the power to define cheating, and by what standard. In Busan, tonight, someone is still awake climbing ranked. Someone will lose their account. Someone will not understand why. And someone will stay silent, keep typing, and wait for another announcement from a company in California. Vanguard does not lock cheating, it locks the chance for someone to believe they are standing in the right place. LoL Park is so quiet that I can hear the mouse clicks clearly, and the hearts of those breaking behind their screens. I hurriedly write down the name of one account under the internet cafe light at 3 a.m., afraid that tomorrow it will vanish from the ranked ladder. Not because they cheated. But because no one had the patience to hear their story before pressing the lock button. Riot did not delete an account, they deleted a span of time someone spent believing in themselves. And in an industry where trust is the scarcest asset, erasing it may be the most expensive decision of all.