How PUBG Anti-Cheat Works — BattlEye + Zakynthos Kernel Coexistence Explained

Between February 23 and March 1, 2026, Krafton's anti-cheat pipeline banned 45,000+ PUBG accounts in a seven-day window — daily average 6,400, peak 8,200 on the Saturday. The official breakdown via the PUBG Weekly Bans Notice attributes 35% to aimbot, 28% to wallhack/ESP, 15% to radar, and 12% to no-recoil scripts specifically — the number nobody expected because PUBG had been historically permissive on mouse-driver-level recoil compensation. The wave wasn't a one-off; it was the public-facing result of an anti-cheat architecture that started shipping in August 2025 and finally reached full coverage. If you want to understand why your 2024-era PUBG cheat stopped working in March 2026, the answer is in this stack.

This post is a cluster of the PUBG Cheats Complete 2026 Guide pillar. The pillar covered the broader market state; this piece goes deep on the kernel-level technical architecture — BattlEye, Zakynthos, behavioral analytics, AI video review, and the voice-chat NLP layer that most cheaters don't even know exists.

The five-layer 2026 PUBG anti-cheat stack

PUBG isn't running a single anti-cheat product. It's running five layers stacked, and every one of them contributes to ban decisions. The kernel layer is what catches the loudest cheats; the behavioral layer is what catches the quiet ones.

Layer 1 — BattlEye (BEDaisy.sys). Third-party kernel anti-cheat from BattlEye Innovations, same vendor used by Rainbow Six Siege, Escape from Tarkov, Arma, Day Z, and a half-dozen other titles. The driver registers Windows callbacks on process creation, thread creation, image loading (DLLs and other drivers), and handle operations. It streams signature definitions from BattlEye's servers — meaning detections can roll out within hours of a vendor analyzing a new cheat. The ACM MATE Workshop 2025 peer-reviewed paper "Battling The Eye" reverse-engineered BEDaisy's actual behavior; it's the most credible public reference for how the driver operates. The secret.club anti-cheat analysis from the security-research community is the older but still-relevant supplement.

Layer 2 — Zakynthos. Krafton's proprietary kernel-mode anti-cheat that launched in August 2025 specifically to fill detection gaps BattlEye didn't cover. The signature design property, confirmed publicly by PUBG dev Alex on X (post 1470616237692833792): "the Zakynthos kernel driver stays engaged as long as the client is running" even if a user force-quits the Zakynthos service. The traditional bypass — kill the AC service before launching the cheat — does nothing here, because the driver is independent of the service. Zakynthos scans kernel memory at the OS kernel layer for code patterns characteristic of cheat drivers, specifically targeting cheats that load BEFORE other security systems initialize. Per PCGamer's coverage of the launch, Zakynthos produced approximately 100,000 bans in its first week of operation.

Layer 3 — Server-side behavioral analytics. Krafton's server pipeline ingests aim-velocity deltas between frames, hit-rate distributions across engagement distances, view-angle change vectors, kill-streak shape, and reaction-time-from-visibility metrics. Statistical outliers get flagged for further review. Behavioral catches are the quiet majority — they don't show up in headline ban-wave numbers because they're not signature-detected, they're flagged-then-confirmed. The growth of behavioral-catch share relative to signature-catch share is one of the under-reported 2025-2026 trends in PUBG anti-cheat.

Layer 4 — AI video review. Krafton deploys machine-learning models against game replay video to identify aimbot snapping patterns, wallhack-style pre-fire behavior, and recoil-curve anomalies visually. Per Krafton's transparency disclosures, AI video review accounted for approximately 39,000 bans through November 2025. The model doesn't need to read your memory; it needs to watch your replay. The implication: a perfectly-built undetected cheat with sloppy user behavior still gets you banned.

Layer 5 — Voice chat NLP. Server-side natural-language processing on in-game voice comms detects cheat-related solicitation and cheat-advertising patterns. This is unusual industry-wide; Krafton has had it deployed for roughly 12 months. If you ask in voice chat for a cheat recommendation or discuss your cheat openly, the account is observation-flagged. Off-platform conversation (Discord, forums) only.

Why Zakynthos is the architectural change that mattered

The shift from BattlEye-only to BattlEye + Zakynthos isn't additive — it's compositional. BattlEye is good at signature-based detection of known cheat code patterns. Zakynthos is good at detecting cheats that operate in kernel-memory regions BattlEye doesn't scan, and at catching the loading-order-evasion technique where a cheat driver loads before the anti-cheat does.

The technical detail that matters: Zakynthos's kernel driver persistence design. The pattern most kernel-AC bypasses use is to inhibit or unload the anti-cheat service before running the cheat. The service-driver relationship in Windows usually means killing the service eventually unloads or pauses the driver. Zakynthos breaks that — Alex's confirmation describes the driver remaining engaged regardless of service state. That's a deliberate architectural choice forcing cheaters into harder territory: you can no longer treat Zakynthos as a service to suppress; you have to deal with the driver itself.

Combined with BattlEye's pre-existing signature streaming, the dual-AC environment means a cheat needs to evade two independently-updated detection mechanisms in the same process boundary. Vendors who didn't have the engineering resources to handle that environment quietly went dark for weeks during August-September 2025. The ones who stayed online — Raw PUBG among them — had been engineering for this environment ahead of public confirmation.

The 2026 Anti-Cheat Roadmap signals

Krafton published the 2026 Anti-Cheat Roadmap on March 25, 2026. Five action items are public:

DMA enforcement remains priority #1. Direct-memory-access hardware cheats — the $500-$1,500 FPGA-based second-PC setups that read game memory bypassing the OS — are explicitly named as the top enforcement target. Krafton issued approximately 260,000 DMA-specific permabans in 2025 per the September 2025 DMA Hacks Update. The roadmap signals continued tightening through H2 2026.

AI video review expansion. The model coverage extends across more match types and to lower-MMR brackets. The expansion is meaningful because behavioral catches at lower brackets have historically been weak — Krafton is closing that gap.

Hardware re-entry blocks reinforced. HWID bans extend to more identifier categories. The cluster on PUBG HWID spoofer guide covers Volume Serial specifically, which most basic spoofers miss but BattlEye reads.

False-ban review system H2 2026. A formal appeal pathway for false positives, rolling out second half of 2026. This is interesting but doesn't help legitimate cheaters — only false-positive players.

Region-specific enforcement. Asia-server-focus detection investment, per the roadmap. Practical implication: if you queue Asian servers, expect higher ban-wave frequency than NA/EU.

What the architecture means for cheat design in 2026

The composite stack creates four design constraints for any PUBG cheat that wants to survive multiple ban waves:

External-only architecture, not internal injection. Both BattlEye and Zakynthos are dramatically more effective at detecting code that lives inside the game process. An external cheat — a separate process reading game memory through kernel-driver-layer access — sidesteps the in-process signature scan entirely. Zakynthos's kernel scans don't sweep memory regions the AC doesn't own; an external design exploits this gap. Raw PUBG is external-only for exactly this reason.

Dynamic recoil compensation, not static scripts. The Feb 2026 wave caught mouse-driver-level static no-recoil scripts (Logitech G-Hub, Razer Synapse, AHK) en masse. The detector statistically analyzed input regularity across multiple engagements; perfectly-repeating curves got flagged. Survival requires reading weapon state in real time, computing inverse compensation per-shot, and randomizing the output with believable human-error distribution. The PUBG aimbot settings cluster covers the implementation math.

Bypass against both ACs simultaneously, not one. Vendors who tuned only for BattlEye half-tuned. A bypass stack has to handle Zakynthos's kernel scan and BattlEye's signature stream as two independent constraints.

Behavioral-aware feature defaults. The behavioral layer doesn't care if your cheat is "undetected" — it cares if your aim curve looks human. Defaults need to ship aim-curve smoothness, FOV cones, and headshot-rate distributions that match human variance, not robot precision. This is product engineering, not bypass engineering.

What this doesn't mean

The stack is real, but the apocalyptic framing some competitors use is overcooked. The 2026 PUBG anti-cheat is not "uncheatable." Properly-engineered external software cheats with dynamic compensation, in-house bypass infrastructure, and HWID spoofer coverage continue to function — that's why Krafton bans 100K accounts per week and the cheating problem persists. The architecture has raised the engineering bar; it hasn't eliminated the market.

What's eliminated: the $5 forum-script tier, the resold loaders from unknown supply chains, the static AHK no-recoil tools. What remains viable: properly-engineered software cheats from vendors with in-house engineering across the stack.

The PUBG ban wave history cluster catalogs the full 2018-2026 timeline of waves and what each one targeted — useful context for understanding the trajectory of where Krafton's detection is heading.

FAQ

Is Zakynthos a kernel-level anti-cheat? Yes. Zakynthos installs a kernel-mode driver that operates at ring 0 (highest CPU privilege on Windows). The persistence design — driver stays engaged independent of the service — is the defining technical characteristic. Per PUBG dev Alex's X post 1470616237692833792, this is intentional and prevents service-suppression bypasses.

Why did Krafton build Zakynthos when BattlEye was already running? BattlEye is signature-driven and externally maintained. Krafton wanted a second kernel layer they could direct at PUBG-specific cheat patterns, particularly around loading-order evasion and kernel-memory regions BattlEye doesn't scan. The pre-Zakynthos detection rate was ~30K/week; post-rollout it climbed to ~100K/week.

Can BattlEye and Zakynthos run simultaneously without conflicts? Yes, that's the entire design intent. The two drivers coexist with different scan responsibilities. Per Krafton's launch documentation at pubg.com/en/news/9001, the design is coexistence rather than replacement.

Does PUBG's AI video review work on private replays only or public ones? Both. Krafton's own match-replay system feeds the model. The AI doesn't need community-uploaded video; the server retains replay data for analysis. Per Krafton's transparency reports, AI video review accounted for ~39,000 bans through November 2025.

How does voice chat NLP work? Server-side natural-language processing on the voice stream identifies patterns associated with cheat advertising and cheat solicitation. The system flags the account for observation; bans typically come downstream from observation-flagging combined with other signals. Don't discuss cheats in PUBG voice chat.

Is the 2026 Anti-Cheat Roadmap binding or just announcement? It's a publicly-stated direction, not a binding commitment. Krafton has shipped on prior roadmap items (Zakynthos was on the 2025 roadmap and arrived in August). Expect H2 2026 to deliver most of what the March 25 post named. Roadmap text at pubg.com/en/news/9856.

What changed in the Feb 2026 wave specifically? Krafton deployed "mouse script manipulation" detection that statistically analyzes input regularity. Per the Dev Letter at pubg.com/en/news/9935, the system identifies pixel-perfect inverse-recoil curves repeated across enough engagements. The 45,000+ accounts caught in the Feb 23-Mar 1 window were predominantly static-script users.

What this means for choosing a cheat

The 2026 anti-cheat architecture rewards vendors with in-house engineering and punishes resellers and forum-script users. If a vendor's marketing copy describes PUBG as "BattlEye-protected" without acknowledging Zakynthos, they're describing 2024 PUBG, not 2026 PUBG. If their no-recoil pitch sounds like an AHK script, the Feb 2026 wave already killed it.

Raw PUBG is external, in-house engineered against the BattlEye + Zakynthos stack, with dynamic recoil compensation that survived the Feb 2026 wave. Pair with Raw Spoofer for Volume Serial HWID coverage. Status posts on the PUBG cheat status page. Full pillar context at PUBG Cheats Complete 2026 Guide.