Solana proposes retiring durable nonces after $270M Drift exploit

By Elena Vasquez

Attackers drained at least $270 million from decentralized exchange Drift on April 1, 2026, and the Solana Foundation has since proposed retiring the Solana durable-nonce mechanism central to the breach. The proposal targets a specific failure mode rather than the smart contracts themselves.

Durable nonces let a signed transaction remain valid indefinitely, even for weeks, before anyone broadcasts it. The Drift attackers relied on that delay to keep pre-signed transactions available until they broadcast them. The Foundation has not set a removal date, so the feature remains on the network.

What did durable nonces change?

An ordinary Solana transaction carries a blockhash tied to a recent block, and it expires after about 30 seconds. Solana now produces a block every 200 milliseconds, or five blocks per second, so an unsent transaction quickly loses practical value. The short window works for many users, but not for institutions that sign across separate parties and secure machines.

Durable nonces replace that short-lived stamp with one that does not go stale. A signed transaction can wait indefinitely for broadcast, which gives custodians and exchanges time to complete offline or multi-party approval processes. In short, the feature solved a custody problem by extending the life of signed authority.

How did the Drift breach unfold?

Drift operated a prominent decentralized exchange on Solana when the April 1 exploit occurred. Estimates put losses at approximately $270 million to $285 million, equal to more than half of total value locked, or more than 50 cents for every dollar counted in protocol TVL.

According to the research findings, the attackers ran a six-month social-engineering campaign aimed at two members of Drift’s Security Council. Once they obtained what they needed, they executed pre-signed transactions that transferred admin control and drained reserves within minutes.

The research reportedly links the attackers to North Korean state-affiliated actors, specifically the group tracked as UNC4736 and also associated with the Lazarus group. That attribution remains a likely link rather than a confirmed identification. The practical lesson is that signer control, not contract code, determined the scale of loss.

What does Solana plan to replace them with?

The Solana Foundation’s deprecation plan shifts toward onchain “programmatic signer” alternatives. These would place signature verification and replay protection directly in Solana’s protocol layer; replay protection prevents the same signed transaction from executing more than once. The aim is to preserve offline signing, but custodians, exchanges, and institutions would need to rebuild approval workflows on different infrastructure.

The deprecation plan sets no final removal date. The changes depend on upcoming audits and a migration window intended to ease the transition, leaving administrators without a firm compliance deadline.

A material caveat remains: the alternatives could leave transfer authorizations valid after a transaction fails, creating lingering exposure rather than eliminating it. The proposal narrows one attack path, but it has not yet removed the old mechanism or established a replacement schedule. In practical terms, the change depends on implementation quality, not merely a policy announcement.

How has Drift responded?

Drift has resumed operations under the new name Velocity, with operational security and signer-risk management presented as the central lessons. The team framed the breach as a failure of systemic controls rather than a flaw in its smart contracts. In its own words, “The code did what it was told. The problem was who was telling it.”

A recovery plan followed, including the introduction of a new token, DFX, intended to support affected users. The token’s stated purpose does not establish a payout schedule, allocation formula, or completed restitution, so DFX should not be treated as proof that every loss has been settled. The name change does not by itself demonstrate that signer-control weaknesses have been resolved.

What should institutions watch?

The research suggests the exploit may make participants more cautious about Solana decentralized finance, while the transition could discourage some usage as institutions adjust. Operationally, exchanges and custodians face a higher burden to redesign signing controls without losing the offline approval flexibility that made durable nonces useful. The proposed replacement addresses a human-process failure, but it has not yet cleared the audits required for deployment.

Three decision points now define the next phase. The Foundation has published no completion dates for them.

• Audit results for the onchain programmatic-signer approach.
• Length of the migration window for affected institutions.
• Whether Solana sets a firm retirement date for durable nonces.

Until those results arrive, durable nonces remain on Solana. The next structural change depends on whether institutions can migrate promptly without reproducing the authorization risks exposed at Drift.