Solana proposes retiring durable nonces after the Drift hack

Loading image

solana-crypto

The feature that let signed transactions wait for weeks was central to the exploit that drained at least $270 million from Drift in April

Mon 9 Nov 2026 · 01:59 EST · 4 min read

In Crypto

Share

Solana’s developers want to kill off a feature that lets a signed transaction sit in a drawer, unsent, for weeks. That feature is called durable nonces, and it was the mechanism attackers relied on to drain at least $270 million from trading protocol Drift in April.

How a feature became an attack vector

Think of a normal Solana transaction as a concert ticket with a very short shelf life. Each one carries a stamp tied to a recent block, known as a blockhash.

That stamp makes the transaction expire after about 30 seconds, now that the network produces blocks every 200 milliseconds. If you sign something and don’t send it quickly, it becomes worthless paper.

Durable nonces swap that short-lived stamp for one that doesn’t go stale. A transaction signed with a durable nonce can stay valid indefinitely, waiting for someone to broadcast it.

That flexibility has real uses. Custodians and exchanges that sign transactions offline, often across multiple parties and secure machines, can’t always hit a 30-second window. Durable nonces gave them breathing room.

What happened at Drift

The Drift exploit hit on April 1, 2026. Drift was a prominent decentralized exchange on Solana, and losses have been estimated at approximately $270 to $285 million.

That figure represented over 50% of the protocol’s total value locked at the time. In other words, more than half of the money users had parked in the platform walked out the door.

The attack didn’t start with code. According to the research findings, the attackers ran a six-month social engineering campaign aimed at two members of Drift’s Security Council.

Once they had what they needed, they executed pre-signed transactions. Those transactions transferred admin control of the protocol and drained its reserves within minutes.

The attackers have reportedly been linked to North Korean state-affiliated actors, with the research pointing to the group tracked as UNC4736, also associated with the Lazarus group. That attribution remains a likely link rather than a confirmed one.

The proposed fix and who pays for it

In response, the Solana Foundation laid out a deprecation plan for durable nonces. The proposal describes a shift toward onchain “programmatic signer” alternatives.

The idea is to move signature verification and replay protection directly into the protocol layer. Replay protection is the safeguard that stops the same signed transaction from being executed more than once.

The plan is designed to preserve offline signing, so custodians aren’t being told to abandon their workflows entirely. They’re being asked to rebuild them on different plumbing.

No definitive removal date has been confirmed. The changes depend on upcoming audits and a migration window meant to help affected users transition.

Those affected users are a specific and important group. Custodians, exchanges, and institutions that rely on offline or multi-party signing would need to adopt the alternatives.

The alternatives are not risk-free either. One concern is that they could leave transfer authorizations valid even after a transaction fails, which is its own flavor of lingering exposure.

Drift’s own read on the breach

Drift has since resumed operations under a new name, Velocity. The team has emphasized operational security and signer-risk management as the core lessons.

Notably, Drift framed the breach as exposing systemic weaknesses rather than flaws in its smart contracts. The code did what it was told. The problem was who was telling it.

A recovery plan followed, including the introduction of a new token, DFX, intended to support affected users.

What this means for Solana and its users

For the Solana ecosystem, the Drift episode is a reminder that DeFi risk lives as much in human process as in code audits. A protocol can pass every smart contract review and still lose half its TVL to a patient adversary.

For investors and traders, the research findings suggest the exploit may make participants more cautious about Solana DeFi, and that the transition could discourage some usage while institutions adjust.

Key things to track from here: the audit results on the programmatic signer approach, the length of the migration window, and whether a firm removal date is eventually set. Until then, durable nonces remain on the network, and so do the habits of the teams that use them.

Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.