Winning Every Battle, Losing the Anti-Cheat War

Most of the anti-cheat conversation is really one question: can you catch cheaters fast enough. That's only half the fight. The other half, and the harder one, is re-entry: once you catch someone, how fast can they come back. Get detection right and ignore re-entry, and the enforcement numbers can look enormous while nothing actually changes for the players experiencing it. PUBG is the clearest, most thoroughly documented case of exactly that gap, and it's worth understanding closely, because the same gap is sitting in the data of almost any live service, whether or not it's banned a single account yet.

Krafton is doing genuinely impressive work

Start with the credit, because it's earned. Krafton's own 2025 Anti-Cheat Dev Letter puts the number at 7.81 million PUBG accounts permanently banned for cheating, as of November 2025, including 260,000 caught using DMA cheats specifically, hardware devices that read game memory directly and are notoriously hard to detect, and roughly 39,000 caught through human video review rather than automated detection alone. The company publishes these numbers regularly and in detail, without much sugarcoating.

The system behind those numbers has several real layers, not just one tool doing all the work:

• Signature and behavioral detection, the baseline system, includes tools built specifically to catch DMA cheats, hardware devices that read game memory directly and are notoriously hard to detect. 260,000 of the total bans came from this category alone.
• Hardware ID (HWID) bans blacklist a cheater's physical PC components, not just their account, so a fresh account on the same banned machine doesn't automatically get back in.
• AI-powered video analysis, new on the 2026 roadmap, flags behavior patterns that signature-based detection alone misses.
• Legal pressure aimed at the people who actually build and sell cheats, not just the players who buy them.

None of it is actually foolproof. DMA cheats exist specifically to get around software-based detection in the first place. HWID bans are real and meaningfully raise the cost of re-entry, but they run into a sustained commercial market of spoofing services built to get around exactly this, not a fringe workaround, one that's reportedly operated continuously for years. AI video analysis is new enough that its real-world catch rate isn't public yet. Every layer here raises the cost and friction of cheating. None of them closes the door completely on its own.

That's why Krafton adds a human layer on top. PUBG Shield puts vetted, trusted players in the loop to review suspected-cheater clips and vote on them, kept deliberately human because it catches subtle cases "an algorithm might miss." That system has its own weak spot worth naming honestly too: the same community that reviews clips through PUBG Shield also has an open report button, and some players use it on anyone who kills them, cheating or not. Other players have called this out directly as a way to get legitimate opponents caught in temporary bans, a detection tool that doesn't automatically stay fair just because it involves people instead of algorithms.

That's already five distinct layers between the technical stack and the human one, and it's not the full list. In my own experience discussing anti-cheat on Rainbow Six Siege, the pattern held every time: externally, we talked about results, and very, very little about methods. Explaining exactly how a detection method works just teaches cheat developers how to beat it, so the public conversation stays on ban numbers instead.

Speed of banning doesn't matter if re-entry is just as fast

But here's the problem with all of it. Krafton's own investigation into its ranked player base found that 85% of accounts permanently banned in ranked play were created before PUBG went free-to-play in January 2022. These aren't fresh throwaway accounts made to dodge a ban. They're older, established accounts, stolen or bought, being used by someone other than the person who created them.

There's a quiet economy behind that number. Someone steals or buys a legitimate account, sells it to a cheater, the cheater burns through it until Krafton catches and bans it, and then buys another one. The bottleneck was never how fast Krafton could detect and ban. It's how large the supply of re-entry vessels is, and that supply barely notices how good the detection gets. Fast detection plus fast banning just resets the clock if re-entry is equally fast. A cheater banned in an afternoon and back by evening hasn't been stopped, they've been mildly inconvenienced. Multiply that by hundreds of thousands of accounts a week and the enforcement numbers can look enormous while the lived experience for players barely changes. That's the full circle: ban, re-enter, ban again, and the loop never actually closes unless something outside detection changes. Krafton's own 2026 roadmap talks about going "beyond one-time penalties to structurally block re-entry," which is a direct admission that penalties alone were never going to be the fix.

It's tempting to read this as something free-to-play games created and paid games are safe from. Ubisoft's own history says otherwise. In 2015, hundreds of Far Cry 4 keys bought with stolen credit cards ended up resold through grey market sites like G2A and Kinguin before Ubisoft caught on and revoked them. Around the same period, indie publisher TinyBuild publicly accused G2A of costing it $450,000 the same way: someone buys a key using a stolen credit card, resells it cheap on a marketplace like G2A, and when the real cardholder later notices the charge and disputes it with their bank, the money gets pulled back out of the publisher's account, not the reseller's. The publisher ends up covering a sale it never actually got paid for. Grey market marketplaces don't only deal in stolen-card keys either. A large share of their inventory comes from something far more mundane: regional pricing. Publishers price the same game lower in some countries than others, and marketplaces exist specifically to buy at the low regional price and resell everywhere else. One mechanism is fraud, the other is closer to legal arbitrage, but they land in the same place: a full-price game becomes available for a few dollars to anyone willing to shop around. Rainbow Six Siege runs one of the more layered anti-cheat stacks in the industry, kernel-level BattlEye, hardware bans, mandatory two-step verification for ranked, and all of it still assumes that getting back in after a ban costs something close to full price. If a banned player can pick up another key for a few dollars, that assumption never held. The free-to-play problem and the paid-game problem turn out to be the same problem, wearing a different price tag.

What this actually means

Studios keep measuring the wrong half of the fight. A ban wave is easy to publish as a number and easy to be proud of. The re-entry rate, how fast a banned player is back in a match, is the number that actually predicts whether players feel safer, and it's far harder to detect. That's why Krafton's 85% finding matters so much as a learning for studios everywhere: the fight was never mostly about catching new cheaters. It was about a supply chain of stolen accounts that detection speed alone can't touch.

That's a live protocols problem as much as a live development one. Any live service with a re-entry cost, free-to-play or paid, has the same account history sitting in its own data: who went dormant, who suddenly came back. If you're running one and you're not using that reactivation pattern as an early flag, you likely have Krafton's problem already, just without 7 million bans yet to notice it by.

The fix doesn't require PUBG's scale either. Route freshly reactivated accounts into matchmaking with each other first, a holding pool of recently-returned accounts playing against other recently-returned accounts, until enough games pass to clear the suspicion or confirm it. That's not a better algorithm. It's a filter built from data almost every live service already collects, and almost none of them are using this way.

Finally, it's a communication problem on top of that. Publishing ban numbers without publishing re-entry numbers invites exactly the disbelief PUBG is getting now, because the number that would actually earn trust is the one nobody's putting on the dev letter.