From Kernel-Level Oversight to Hardware “Paperweights”
Riot Games has escalated its fight against cheaters in Valorant by upgrading the Vanguard anti-cheat system to specifically target DMA cheat hardware. These sophisticated external devices, used to bypass the Valorant anti-cheat system, can cost around USD 6,000 (approx. RM27,600) and are designed to operate below the radar of traditional software-based detection. Because Vanguard runs at the kernel level, it already has unusually deep access to a user’s operating system. The new Vanguard update uses that privileged position to identify and block the firmware that powers many of these devices, turning them into what Riot has mockingly described as “$6k paperweights.” Some affected users report that their systems could not boot into Windows until they reinstalled the OS, underlining how aggressively the update now intervenes when it detects unauthorized hardware trying to interface with the game.
What Makes DMA Cheat Hardware So Difficult to Detect
Direct Memory Access, or DMA, is a legitimate hardware capability that lets components read and write system memory without routing every request through the CPU. DMA cheat hardware abuses this feature by impersonating trusted devices and reading game memory externally, often through PCIe connections. In a typical setup, a separate machine runs cheat tools like radar, wallhacks, or ESP overlays, all powered by live data siphoned from the victim’s gaming PC. Because this external hardware operates outside the normal software stack and can masquerade as standard storage or other peripherals, it is extremely difficult for conventional anti-cheat tools to spot. This is why these devices command such high prices on the grey market and why Riot’s decision to confront them at the hardware level marks a significant evolution in competitive gaming security, especially for a title as sensitive to integrity as Valorant.
How the Vanguard Update Uses IOMMU to Cut Off Cheaters
The latest Vanguard update appears to close a loophole that high-end DMA setups were exploiting. These devices often present themselves as SATA or NVMe storage so they can interact with memory that the Valorant anti-cheat system expects to trust. Riot responded by working with motherboard vendors like MSI, ASUS, and ASRock and by enforcing stricter use of IOMMU, the Input-Output Memory Management Unit that governs which devices can access which memory regions. By tightening those permissions, Vanguard can prevent suspicious external devices from reading live game data at all. When Vanguard detects a DMA-based cheat, it can trigger in-game IOMMU restart warnings and sever communication between the PC and the cheat device, leaving the firmware unusable even outside the game. In some cases, users report needing to reinstall Windows, a sign of how thoroughly the device’s access paths have been shut down.
Did Vanguard Really “Brick” Hardware, and What Are the Risks?
Reports quickly surfaced claiming that Valorant’s anti-cheat had damaged SSDs or bricked entire systems, but Riot has pushed back on that narrative. The company says Vanguard does not damage PC hardware, disable genuine SSDs, or intentionally render normal components unusable. According to Riot, the instability arises when IOMMU protections are enabled and cheat hardware continues trying to access protected memory, which naturally leads to hardware faults or crashes. This is consistent with how IOMMU is designed to behave when a device violates its access rules. Still, the idea that kernel-level software can effectively block hardware at boot has unsettled some players. Community discussions now revolve around what might happen in a worst-case false positive, where legitimate NVMe or SATA devices are misidentified and locked out, potentially forcing users into disruptive recoveries even if no physical damage occurs.
A New Benchmark for Competitive Gaming Security
By extending Vanguard’s reach deeper into hardware-level memory protections, Riot is setting a new bar for competitive gaming security. The Valorant anti-cheat system is no longer focused solely on catching suspicious processes or overlays; it now actively polices how connected devices interact with system memory. For many players, the fact that USD 6,000 (approx. RM27,600) DMA rigs can be neutralized overnight is a satisfying sign that cheating is becoming more expensive and risky. At the same time, the move intensifies the longstanding cat-and-mouse dynamic between cheat developers and anti-cheat teams. Future DMA tools will likely try even more sophisticated disguises, while publishers weigh the benefits of Vanguard-style kernel access against the trust concerns it raises. As other competitive titles study Riot’s approach, the debate over how far anti-cheat systems should reach into user hardware is only just beginning.