Riot Games’ Valorant anti-cheat DMA hardware defense just made thousands of dollars in cheating equipment worthless. The company deployed a Vanguard update targeting Direct Memory Access devices—expensive hardware-based cheats that previously evaded detection by reading RAM directly and bypassing CPU-level security. The update closes a pre-boot loophole in motherboard firmware that allowed this class of cheats to operate undetected, and Riot’s response on social media made the stakes crystal clear: the company tweeted “congrats to the owners of a brand new $6k paperweight”.
Key Takeaways
- Riot’s Vanguard update blocks the majority of DMA cheating devices, which cost up to $6,000 and previously evaded detection.
- The update targets a pre-boot security gap in motherboard firmware that DMA cheats exploited to inject code undetected.
- Affected users see a VAN:Restriction warning and cannot play Valorant until they enable security features or update motherboard firmware.
- Riot worked with hardware manufacturers to validate the vulnerability and produce BIOS updates addressing the loophole.
- The company’s public mockery of cheaters amplified the story and underscored the severity of the anti-cheat enforcement.
How Valorant Anti-Cheat DMA Hardware Cheats Worked
DMA cheating hardware operates by reading a computer’s RAM directly, bypassing the game PC’s CPU and standard security layers entirely. This architecture made DMA cheats nearly invisible to traditional anti-cheat systems because the cheat code never runs on the main processor where Vanguard could detect it. Instead, the hardware communicates with the game’s memory from outside the system, feeding aiming data or wall-hack information directly into the game’s processes. The devices cost thousands of dollars precisely because they required specialized hardware and firmware to achieve this level of evasion.
The vulnerability Riot exploited was not in Vanguard itself but in a gap that existed before Windows even booted. Cheaters had been using a pre-boot loophole in motherboard firmware—a security gap that allowed code injection to occur unnoticed during the system startup sequence. By the time Vanguard loaded, the malicious firmware was already active, and the operating system had no way to detect it. This “untouchable” status made DMA cheats the most expensive and most effective way to cheat at Valorant.
Riot’s Motherboard Firmware Fix Neutralizes an Entire Cheat Class
Riot’s response was to work directly with hardware manufacturers to validate the vulnerability and produce BIOS updates that close the pre-boot gap. The company updated Vanguard to detect when a system’s security features are not active from the first millisecond of power-on. If Vanguard identifies a motherboard with the vulnerable firmware or disabled security settings, it issues a VAN:Restriction warning and prevents the player from launching Valorant.
The restriction does not necessarily mean Riot suspects the user of cheating. Instead, the system configuration itself resembles setups commonly used to evade detection. Players can resolve the warning by enabling the relevant security features in their BIOS or by updating their motherboard firmware using the manufacturer’s official guidance. Riot says that by closing this pre-boot loophole, it has neutralized an entire class of previously untouchable cheats and significantly raised the cost of unfair play.
For users with already-compromised DMA firmware, the situation is more severe. The affected hardware can remain unusable even after uninstalling Vanguard or closing Valorant, according to reports cited in coverage of the update. Some affected cheaters claim the only viable fix is a complete operating system reinstall, which further underscores the permanence of Riot’s enforcement action.
Riot’s Trolling Amplifies the Message
What elevated this from a routine anti-cheat update to a cultural moment was Riot’s social media response. The company’s anti-cheat account posted a message congratulating owners of a brand new $6,000 paperweight, a reference to the now-inoperable DMA hardware sitting in cheaters’ PCs. The mockery was deliberate and public—a statement that Riot was not just fixing a technical vulnerability but actively celebrating the financial loss of cheaters who had invested heavily in evasion technology.
This approach divided the gaming community. Some players viewed it as justified comeuppance for cheaters who had degraded competitive integrity. Others criticized Riot for what they saw as excessive public shaming. Regardless of perspective, the tactic worked: it drew mainstream attention to the anti-cheat update and sent a clear signal that Riot was willing to take aggressive action against sophisticated cheating infrastructure, not just individual cheaters.
What Happens to Players Caught by VAN:Restriction?
If a player receives a VAN:Restriction warning, they cannot launch Valorant until they resolve the underlying hardware or firmware issue. Riot’s official guidance directs affected users to visit their motherboard manufacturer’s website and download the latest BIOS update. This process requires access to the BIOS menu during startup and typically involves creating a bootable USB drive with the updated firmware. For non-technical users, the barrier is significant.
Riot emphasizes that users can proactively update their motherboard firmware even before receiving a warning, which serves as a preventive measure for legitimate players whose systems happen to match vulnerable configurations. The company frames this as a security improvement, not just an anti-cheat mechanism—the same firmware updates that block DMA cheats also improve overall system security by closing a pre-boot injection vulnerability.
Does VAN:Restriction mean I’m suspected of cheating?
No. Riot explicitly states that receiving a VAN:Restriction warning does not necessarily mean the company suspects you of cheating. The restriction is triggered by system configuration issues—disabled security features or outdated motherboard firmware—that can resemble configurations used to evade detection. Legitimate players with older motherboards or systems that disabled security features for compatibility reasons may receive the warning and can resolve it by updating firmware or enabling security settings.
Can DMA cheating hardware be used on other games?
The research brief does not address whether affected DMA hardware can function with other games or anti-cheat systems. Valorant anti-cheat DMA hardware is specifically designed to evade Vanguard, and the update targets the pre-boot loophole that made this possible. Whether the same hardware remains functional against other anti-cheat systems or games is outside the scope of Riot’s disclosed technical details.
How much does DMA cheating hardware cost?
DMA cheating devices discussed in the update cost up to $6,000, which reflects their specialized hardware and firmware engineering. This price point is what made Riot’s social media jab—congratulating owners of a $6,000 paperweight—so pointed. The financial loss for cheaters who invested in these devices and now cannot use them in Valorant is substantial, and that consequence is central to Riot’s claim that it has raised the cost of cheating significantly.
Riot’s Vanguard anti-cheat DMA hardware update represents a shift in how game studios approach cheating enforcement. Rather than playing catch-up with software-based cheats, Riot identified the architectural vulnerability enabling the most expensive and sophisticated cheating hardware and closed it at the firmware level. The public mockery afterward served as both a victory lap and a warning: invest in cheating infrastructure at your own financial risk.
Edited by the All Things Geek team.
Source: Tom's Hardware
