Solana moves to retire durable nonces after $270 million Drift hack

Solana developers want to remove the transaction feature attackers used to drain at least $270 million from the Drift trading platform. A draft filed on 5 November would retire durable nonces, a tool that keeps a signed transaction valid for weeks rather than seconds.

Gabe Rodriguez, an engineer at Anza, the firm that builds Solana's main validator software, filed the proposal, known as SIMD-0723. The document is a draft. It has not been approved, and Solana's biggest changes need sign-off from at least one engineer at Anza and one at Firedancer, the rival software built by the trading firm Jump. CoinDesk and Crypto Briefing both reported the filing on 9 November.

What durable nonces do

Most Solana transactions carry a recent blockhash, a short code that proves the transaction is fresh. That code dies after about 30 seconds. Miss the window and the transaction fails. Durable nonces remove that clock. They swap the expiring code for a fixed marker that never goes stale, so a transaction signed today can be broadcast next month.

Think of it like a signed check with no date on it. Convenient if you plan to post it slowly. Dangerous if someone else holds it and cashes it when you least expect.

The feature exists for good reasons. Custodians, exchanges and funds often sign transactions on offline machines kept away from the internet, sometimes with several people approving in turn. That can take far longer than 30 seconds, so a transaction that never expires solves a real problem.

How the Drift attack used them

On 1 April 2026, attackers emptied Drift, one of the largest trading platforms on Solana. The loss reached at least $270 million, more than half of the money users had deposited at the time. Some estimates put it near $285 million. It was the biggest theft of the Solana era.

This was not a bug in the code. Attackers spent months working on people with signing power, getting them to approve transactions that looked routine. Because durable nonces carry no expiry, those approvals sat unused for more than a week, then ran together and moved the funds out in minutes.

Drift later blamed a hacking group tied to North Korea. That link has not been independently confirmed. Most of the money has not been recovered.

What the proposal would change

SIMD-0723 would make every Solana transaction need a recent blockhash again. It would also switch off the system instructions that create and update nonce accounts. In plain terms, the never-expiring transaction would stop working.

Removing the feature would not stop the trick that started the Drift theft. Social engineering still works. It would only close the window that let stolen approvals wait for the right moment.

Oddly, the proposal never mentions Drift by name. It points instead to years of smaller faults tied to the feature, including a 2022 incident that stopped the Solana network for about four and a half hours.

Few accounts rely on it. One set of measurements from June, cited by researcher Max Resnick, found durable nonce transactions made up roughly 3 percent of traffic yet paid 30 percent of priority fees. Priority fees are the extra users pay to jump the queue. Just 555 accounts sent 97.5 percent of those transactions. The data does not say who runs those accounts.

This is not the first try at curbing the feature. In June, Resnick filed a softer proposal, SIMD-0571, that would have pulled the priority fee from durable nonce transactions and pushed them to the back of the queue rather than delete them. The new draft goes further and removes them outright.

Who has to change how they sign

The burden falls on the careful ones. Custodians and exchanges that sign offline, on air-gapped machines, lean on durable nonces precisely because their approvals take time. Strip the feature out and they have to rebuild how they move money.

Replacements already exist. The proposal points to onchain programs, sometimes called programmatic signers, among them Anza's own Programmatic Signer and Blueshift's Vector. These push the checks that stop a transaction being replayed into the network's own code. A replay is when an old, valid transaction gets sent a second time.

They come with a catch. A failed transaction can leave the underlying approval still usable, so a failure is not the same as a cancellation. Anyone who has had to revoke a token approval after a close call will know the shape of that risk.

What to watch

No removal date is set. The draft says the change would not reach Solana's main network before 5 May 2027, and it promises users at least six months to move across, counted from the 5 November filing. The Solana Foundation's deprecation page is vaguer still. It reads 'No date set' and starts the six-month clock only once a working replacement is ready, which could push the cutoff past spring.

Approval is not guaranteed. Validator engineers on both main software teams have to agree before anything ships, and a change this disruptive to custodians will draw argument.

For users, nothing changes today. Durable nonces still work. Anyone building offline signing on Solana should read the draft now and plan a route off the feature, rather than wait for a date that keeps slipping.

SOL traded near $86 early on 9 November 2026, down about 4 percent over 24 hours, according to CoinGecko, as the wider market fell. This is a slow governance fight, not a price event. A tool added for convenience became the path to one of the year's worst thefts. Crypto keeps relearning that lesson, one exploit at a time.