Solana’s developers are proposing to retire durable nonces, a transaction feature that allows signed transactions to remain valid indefinitely, after it was exploited in the April hack of trading protocol Drift that drained at least $270 million.
How durable nonces work
On Solana, a standard transaction includes a blockhash that ties it to a recent block. With blocks now produced every 200 milliseconds, that stamp causes the transaction to expire after about 30 seconds. If it is not sent quickly, it becomes invalid.
Durable nonces replace that short-lived stamp with one that does not expire, so a signed transaction can wait indefinitely to be broadcast. This flexibility is used by custodians and exchanges that sign transactions offline, often across multiple parties and secure machines, and cannot always meet a 30-second window.
The Drift exploit
The Drift exploit occurred on April 1, 2026. Drift was a prominent decentralized exchange on Solana, and losses have been estimated at approximately $270 to $285 million—over 50% of the protocol’s total value locked at the time.
According to research findings, the attack began with a six-month social engineering campaign targeting two members of Drift’s Security Council. The attackers then executed pre-signed transactions that transferred admin control of the protocol and drained its reserves within minutes.
The attackers have reportedly been linked to North Korean state-affiliated actors, with the research pointing to the group tracked as UNC4736, also associated with the Lazarus group. That attribution remains a likely link rather than a confirmed one.
Proposed fix and migration
In response, the Solana Foundation has outlined a deprecation plan for durable nonces. The proposal describes a shift toward onchain “programmatic signer” alternatives, moving signature verification and replay protection directly into the protocol layer. Replay protection prevents the same signed transaction from being executed more than once.
The plan aims to preserve offline signing, so custodians are not being asked to abandon their workflows entirely but to rebuild them on different infrastructure. No definitive removal date has been confirmed; the changes depend on upcoming audits and a migration window to help affected users transition.
Affected users include custodians, exchanges, and institutions that rely on offline or multi-party signing. The alternatives are not risk-free either—one concern is that they could leave transfer authorizations valid even after a transaction fails.
Drift’s response
Drift has since resumed operations under a new name, Velocity. The team has emphasized operational security and signer-risk management as the core lessons, framing the breach as exposing systemic weaknesses rather than flaws in its smart contracts. A recovery plan followed, including the introduction of a new token, DFX, intended to support affected users.
Implications for Solana
For the Solana ecosystem, the Drift episode is a reminder that DeFi risk lives as much in human process as in code audits. A protocol can pass every smart contract review and still lose half its TVL to a patient adversary.
For investors and traders, the research findings suggest the exploit may make participants more cautious about Solana DeFi, and that the transition could discourage some usage while institutions adjust.
Key things to track from here: the audit results on the programmatic signer approach, the length of the migration window, and whether a firm removal date is eventually set. Until then, durable nonces remain on the network, and so do the habits of the teams that use them.
