Vanguard’s Heavy Hand: Riot Games Escalates the War on DMA Cheating in Valorant

By Craig Robinson, Senior Editor
Last Updated: May 22, 2026

In an aggressive maneuver that has sent shockwaves through the illicit gaming hardware market, Riot Games has deployed a significant update to its Vanguard anti-cheat system. The update, which specifically targets Direct Memory Access (DMA) cheats, represents one of the most sophisticated counter-offensives in the history of competitive gaming. By leveraging hardware-level security features, Riot is not merely banning accounts; they are effectively neutralizing the expensive, specialized hardware that facilitates high-end cheating in Valorant.

The update has led to widespread reports of blue-screening and system instability among users employing DMA devices. While some users claim their hardware has been permanently "bricked," the reality is a complex technical standoff between kernel-level security and the underground industry of cheat development.

Understanding the DMA Threat

To understand the gravity of this update, one must first understand the architecture of DMA cheating. Unlike traditional "software cheats" that run on the same operating system as the game—making them susceptible to detection by anti-cheat scanners—DMA cheats operate on an entirely different plane.

A typical DMA setup involves a secondary computer connected to the primary gaming PC via a PCIe DMA card. The card acts as a bridge, allowing the secondary machine to read the RAM of the primary PC in real-time. By pulling data such as player coordinates, enemy health bars, and game state directly from memory, the cheat software can overlay information on a second monitor without ever interacting with the primary PC’s operating system or software environment.

For years, this method has been the "holy grail" of cheating. Because the DMA card disguises itself as legitimate hardware—such as a network card or a storage controller—it avoids traditional detection. The ongoing war between Riot’s anti-cheat team and cheat developers has largely been a game of "firmware cat-and-mouse," where developers update their device signatures to mimic innocuous hardware, and Riot attempts to identify and blacklist them.

The Chronology of the Escalation

The discovery of this massive crackdown began on online forums and Discord servers, where users reported that a routine update to the Vanguard Kernel (VGK) was causing catastrophic failures for their setups.

• Initial Reports: As the update rolled out globally, users of popular DMA hardware began reporting immediate system crashes. The reports shared a common theme: after Vanguard initiated a check, the system would blue-screen, often rendering the machine unable to boot into the operating system.
• The Technical Trigger: Hacking journalist Osisada, who has been tracking these developments, noted that the update began triggering the Input-Output Memory Management Unit (IOMMU). This is a vital security feature built into modern CPUs and motherboards that manages the memory access permissions for peripheral devices.
• Widespread Panic: The community response was immediate. Many users found that their DMA devices—which often cost hundreds of dollars—were no longer recognized by their primary PC. In some cases, the disruption was so severe that users reported needing to perform a full, clean installation of their operating system to regain basic functionality.
• The "Bricking" Debate: As word spread, the term "bricking" began to trend. The narrative took hold that Riot was intentionally destroying the physical hardware of its players, a claim that sparked intense ethical and legal debate across platforms like Reddit and X (formerly Twitter).

Official Responses: Fact vs. Fiction

As the controversy grew, Phillip Koskinas, a prominent member of Riot’s anti-cheat team, took to social media to clarify the situation. Addressing the claims that Riot was destroying hardware, Koskinas was blunt: "It doesn’t brick the hardware, lol."

According to Koskinas, the system is simply enforcing strict security protocols. "We just require IOMMU on accounts using the device, which denies it access to game memory," he explained. "You’d hardware fault if you still tried to cheat with IOMMU enabled, but that doesn’t hurt anything other than the cheater’s ego."

This clarification suggests that the "bricking" effect is a byproduct of the cheat hardware’s own firmware failing to handle the IOMMU restriction. When the hardware is denied the illicit access it was designed for, it crashes the system—not because of malicious intent from Riot, but because the cheat hardware cannot function within a secure, standard computing environment.

The Implications for Competitive Integrity

The impact of this update goes far beyond the immediate frustration of those attempting to circumvent the rules. It sets a new precedent for how developers handle the "arms race" of cheating.

1. Increasing the Cost of Entry

Historically, a cheater’s primary risk was losing an account. With account bans often circumvented by purchasing "smurf" accounts for a few dollars, the deterrent was minimal. However, DMA setups represent a significant financial investment—often costing between $300 and $600 for the card, the cables, and the secondary PC. By rendering this hardware non-functional, Riot has drastically increased the "cost of cheating." If a single patch can neutralize hundreds of dollars of equipment, the risk-to-reward ratio for potential cheaters shifts significantly.

2. A Paradigm Shift in Detection

By leaning on hardware-level features like IOMMU, Riot is signaling that they are moving the battlefield from the software layer to the hardware layer. This is a profound shift. It forces cheat developers to find ways to bypass hardware-level security, which is significantly more difficult than modifying software code. This strategy essentially turns the player’s motherboard and CPU into part of the anti-cheat team.

3. Ethical and Philosophical Concerns

The move has not been without its critics. The Linux gaming community, in particular, has expressed concerns regarding the level of access kernel-level anti-cheats (like Vanguard) require. Critics argue that forcing IOMMU settings and monitoring hardware at such a deep level is an intrusive practice that pushes the boundaries of user control. There is a fine line between maintaining game integrity and invading the user’s computing space, and this latest update has reignited that long-standing debate.

The Future of the Arms Race

Will this end DMA cheating? Almost certainly not. The history of cybersecurity proves that for every barrier, there is a bypass. Developers of cheat firmware will undoubtedly work to engineer new ways to emulate hardware that can bypass IOMMU checks or spoof devices in ways that appear compliant with Riot’s new standards.

However, the speed and efficiency with which Riot responded to this threat demonstrate a level of sophistication that was absent in the early days of esports. By utilizing the very hardware that the cheaters rely on to expose them, Riot has successfully disrupted the market for "undetectable" cheating.

Conclusion: A Win for the Fair Player

For the average Valorant player, the takeaway is largely positive. The presence of DMA cheaters in high-ranked lobbies has long been a source of frustration, with players often feeling helpless against opponents who have an unfair, invisible advantage.

While the battle for digital integrity will continue, this update serves as a powerful reminder: the developers of competitive games are no longer content to play defense. By making cheating technically and financially untenable, Riot is sending a clear message to the underground community. The next time you enter a ranked lobby, you can do so with the knowledge that the barrier to entry for the "invisible" cheaters has just become significantly higher. The arms race is far from over, but for today, the defenders have landed a heavy blow.