Blizzard Anti-Cheat HWID Bans — How They Work & How to Bypass

Blizzard Anti-Cheat is the proprietary security system protecting Overwatch 2, developed and maintained by Blizzard Entertainment's internal security team. It evolved from Warden, the anti-cheat technology Blizzard first developed for World of Warcraft in the mid-2000s, but has been significantly modernized for the competitive requirements of Overwatch 2.

As a publisher-owned system, Blizzard Anti-Cheat is tightly integrated with Battle.net, Blizzard's account and launcher platform. This integration gives it access to both hardware-level and account-level data, creating a multi-layered identification system. When a hardware ban is issued, it is enforced through Battle.net — meaning any new account connecting from the same machine is flagged immediately.

Blizzard has taken an increasingly aggressive stance on hardware bans in Overwatch 2, particularly after the game moved to free-to-play. Without a purchase barrier, HWID bans became the primary deterrent against repeat offenders.

Blizzard Anti-Cheat collects hardware identifiers through a combination of its game client, the Battle.net launcher, and a system-level component. Because Blizzard controls both the game and the distribution platform, it can collect data at multiple points — during launcher login, game launch, and throughout the play session. The identifiers it tracks include:

Disk drive serial numbers — firmware-level serials from all connected storage devices. Blizzard's system queries storage controllers directly for serials that persist across formats and reinstalls.

Motherboard and BIOS identifiers — system UUID, board serial, and BIOS version from SMBIOS tables. These form the foundation of the hardware fingerprint.

Network adapter MAC addresses — all physical adapters are enumerated. Blizzard Anti-Cheat logs both the MAC address and the adapter model name for cross-reference.

Display identifiers — EDID (Extended Display Identification Data) from connected monitors. This adds a secondary fingerprint dimension that is difficult to change without physical hardware swaps.

Battle.net client data — cached authentication tokens, installation UUIDs, and machine-specific Battle.net identifiers. These are tightly coupled with the hardware fingerprint to prevent ban evasion through account rotation.

Blizzard Anti-Cheat uses composite matching similar to BattlEye and EAC. Changing one or two identifiers is insufficient — the system requires a near-complete identity change to consider a machine "new." Hardware bans are permanent and tied to the machine, not the account. Creating a new Battle.net account on banned hardware results in an immediate ban, often before the player can complete their first match.

TraceX addresses Blizzard Anti-Cheat's multi-layered approach by spoofing identifiers at every collection point — hardware controllers, OS-level APIs, and application-level caches. When you run TraceX once:

All hardware serials (disk, motherboard, BIOS) are replaced with clean values before Blizzard's system reads them. The spoofed values pass format validation and appear as genuine hardware.

MAC addresses and display EDID data are regenerated with valid, manufacturer-consistent values.

Battle.net-specific cached data and machine identifiers are cleaned, ensuring no residual tokens link the new session to a banned profile.

Windows installation identifiers are rotated to match a fresh OS install.

The result is a completely new machine identity at every layer Blizzard checks. A new Battle.net account connects with a clean hardware fingerprint, clean platform cache, and clean OS identifiers. TraceX has remained undetected against Blizzard Anti-Cheat since its launch.