The VALORANT Instagram hack and gaming security

On March 20, 2025, VALORANT's official Instagram account briefly promoted a false crypto message. 

Riot confirmed the account had been hacked and that related Riot social properties were also used in the scam pattern. The incident passed and did not become a long-running public disaster. But it was still able to reach an audience of  2.2 million Instagram followers.

Gaming audiences move quickly, discuss quickly, screenshot quickly, and click quickly.

When an official account appears to announce something tied to a known player, esports moment, reward, skin, tournament, or limited drop, audiences take action, fast! And that means a few minutes or hours is plenty of time to do damage. 

‍Gaming social accounts are not only marketing channels. They are trust switches for high-speed communities, making them ripe targets for attackers. 

TLDR

• The VALORANT incident shows how a short account compromise can still create high-risk fan exposure
• Gaming communities are vulnerable because official accounts often announce rewards, creators, teams, drops, events, and urgent updates
• Gaming brands need social account controls built around speed: pre-approved links, access reviews, monitoring, and first-minute fan warnings

Gaming communities create a different security problem

Players are used to claiming rewards, checking event pages, joining Discord servers, watching streams, entering codes, and reacting to creator news. All in minutes. 

A fake post promising a token, skin, tournament entry, beta invite, creator drop, or account verification page can move fans toward a malicious link before the brand's internal team even notices, let alone starts taking action.

Riot's own VALORANT support guidance tells users to verify URLs and never log in with Riot credentials anywhere except the official authentication domain. That advice is exactly right for players. Brands need the matching operational control on the publishing side.

But many users don’t have this front of mind when hype and FOMO take over. 

The scam does not need to be believable to everyone

An obvious scam to one group of fans may still catch enough users in the first few minutes to make the attack worthwhile. 

The attacker does not need universal belief. They only need urgency, novelty, and a small conversion rate from a large audience.

‍Kaspersky reported a campaign involving fake open-source projects targeting gamers and crypto investors, including projects referencing VALORANT. By their account, attackers stole about 5 BTC, worth approximately $485,000 at the time.

What gaming brands should protect first

Gaming brands, and any company, should classify social posts by the type of action they request from fans.

• Login request: any post that sends fans toward authentication is high risk
• Reward claim: skins, codes, drops, beta access, tournament entries, and giveaways require verified links
• Creator or player reference: posts using known players or creators can convert faster because the fan trust is already present
• Crypto or payment language: any token, wallet, merch, marketplace, or payment claim should trigger immediate verification
• Off-platform movement: Discord, Telegram, WhatsApp, and unfamiliar domains should never be introduced casually from a compromised account
• Emergency announcement: account bans, server issues, account resets, or security notices need a known source-of-truth page

This risk classification is simple enough for marketing teams to use, but specific enough for security teams to monitor.

The first-minute fan warning is a security control

Gaming teams often think of public communication as reputation management. During a social account compromise, communication is containment.

If the official Instagram account posts a scam, the brand should have a ready-to-use warning for X, Discord, the game launcher, the website, and any other verified channel. The message should say which account is affected, which links to ignore, and what the brand will never ask players to do.

‍A fast warning can stop more damage than a perfect investigation update delivered two hours later.

The warning should be written before an incident. During a live compromise, every extra approval step gives the attacker more time with the audience.

The control model for gaming social teams

The right control model has to match the speed of the community.

• Before launches: review admins, agencies, creators, scheduled posts, connected tools, recovery email, phone number, and 2FA status
• During high-attention windows: monitor official accounts continuously for unusual posts, link changes, login anomalies, and comment warnings
• After suspicious activity: revoke sessions, freeze scheduled content, rotate credentials, disconnect unknown tools, and issue a public warning
• Every month: remove former employees, expired agency users, unused integrations, and personal devices that no longer need access

This is not heavy bureaucracy. It is event operations. 

Gaming companies already run launch calendars, tournament calendars, patch calendars, creator calendars, and community calendars. 

Security has to be part of that operating rhythm.

Sources and further reading

• Riot Games VALORANT Support: Protecting Your Account. support-valorant.riotgames.com/hc/en-us/articles/4402974266003-Protecting-Your-Account
• Kaspersky: Hidden Malware on GitHub Stealing Personal Data and $485,000 in Bitcoin. kaspersky.com.au/about/press-releases/kaspersky-exposes-hidden-malware-on-github-stealing-personal-data-and-485000-in-bitcoin
• Spikerz: 6 Security Lessons from Riot's VALORANT Instagram Hack. spikerz.com/blog/6-security-lessons-from-riots-valorant-instagram-hack

Written by Nave Ben Dror, CEO and Co-founder at Spikerz. Spikerz protects gaming, creator, and brand accounts from account takeover, impersonation, phishing, scam comments, and community abuse across major social platforms. Connect with Spikerz on LinkedIn or visit the Spikerz About page.

Spikerz monitors gaming and brand social accounts for unauthorized access, suspicious links, scam comments, impersonators, and phishing messages before fans are put at risk. Book a demo at spikerz.com