Solana Moves to Retire Durable Nonces, the Feature Behind the $270 Million Drift Hack

Published November 10, 2026, 9:12 AM PKT. Based on the SIMD-0723 draft proposal published November 5, 2026, with reporting from CoinDesk and Unchained published November 9, 2026.

Solana ($SOL) developers have proposed retiring durable nonces, the transaction feature attackers exploited to steal at least $270 million from Drift in April 2026. The draft proposal, known as SIMD-0723, was filed on November 5 by Gabe Rodriguez of Anza, the firm behind Solana's main validator software, and would require every transaction on the network to carry a recent blockhash once the change activates. That activation cannot happen before May 5, 2027, giving the heaviest users of the feature at least six months to rebuild how they sign transactions.

The proposal is still a draft, with no approvals, and it still needs sign-off from at least one engineer at Anza and one at Firedancer, the rival validator client built by Jump, before it can move toward activation. The Solana Foundation's own deprecation page still lists no date for the cutoff, and its six-month migration clock starts only once a replacement is ready, which could push the real deadline past May 2027.

A signature that never expires

A durable nonce is a stored value in a dedicated account that stands in for a recent blockhash, the short-lived reference to a recent block that every Solana transaction normally carries. A normal blockhash goes stale after about 150 blocks, roughly 30 seconds, and the transaction can no longer land. A durable nonce removes that expiry, so a transaction can be signed now and sent weeks or months later.

That permanence is what makes the feature useful, and what makes it dangerous. Custodians and exchanges use it to sign transactions on air-gapped machines kept off the internet, where approvals can outlast the 150-block window. The keys that control issuance of USD Coin ($USDC) and Tether ($USDT), known as mint authorities, were listed among the feature's notable users in a discussion earlier this year. Under SIMD-0723, every transaction would need a recent blockhash once the change activates, and the instructions in Solana's built-in System Program that initialize, advance and upgrade nonce accounts would be switched off. The two instructions that let owners pull funds out of a nonce account or reassign control would keep working, and existing accounts would not be touched.

The Drift hack: approvals signed, then held for a week

The proposal does not mention Drift, but the April 1 attack on the Solana-based perpetual futures exchange is the reason the feature is now on the chopping block. Attackers obtained pre-signed approvals, let those transactions sit untouched for more than a week, and then fired them off to drain at least $270 million from Drift, according to CoinDesk's early reporting. Chainalysis later estimated the loss at about $285 million, while Drift put it at $295.7 million by its own accounting. Drift later blamed a North Korean state-affiliated group, and in its recovery plan it called the durable-nonce attack surface "central to how the April 1 exploit was executed". The exploiter has since moved more than $100 million in Ether ($ETH) through the Tornado Cash mixer, according to onchain trackers.

Instead of citing Drift, the proposal builds its case on years of bugs tied to the feature. The draft points to a 2022 incident in which validators ran one failed transaction down both the standard blockhash route and the nonce route, stalling the Solana mainnet for about 4.5 hours.

The 2022 outage and the fee numbers behind the case

The numbers behind the proposal show a feature used by very few accounts for outsized effect. Data from researcher Max Resnick, cited in the proposal's discussion, showed durable nonce transactions made up only about 3.1 percent of Solana's transactions during one measured period in June, yet accounted for roughly 30 percent of all priority fees paid on the network. Just 555 of the 103,672 accounts paying fees on nonce transactions were responsible for 97.5 percent of that volume.

For most Solana users the change would be invisible. Ordinary wallets sign and send within seconds, well inside the 150-block window, so retiring durable nonces changes nothing about how they transact. The burden falls on the small group of heavy users whose signing workflows were built around the feature never expiring.

Custodians get six months, and two replacements to build on

The draft singles out custodians and exchanges whose approvals on air-gapped machines can outlast the 150-block window, and says they will have to rework that process. In March, Michael Gutkin of Fireblocks, which he described as managing millions of Solana wallets, wrote that durable nonce deprecation "seems like the right direction", but added that if accounts had to be migrated with no compatibility bridge, such as one wrapping transactions signed in advance, "12 months is the minimum we believe is feasible at institutional scale". SIMD-0723 rejects that wrapping approach and allows at least six months, counted from the proposal's publication on November 5.

The proposal points to two replacements: Anza's Programmatic Signer and Blueshift's Vector. In both, an owner hands its authority to a program-derived address, an account controlled by a program instead of a private key, signs approvals offline and passes them to a third party, or relayer, and the program checks each signature onchain before running the instructions. Rodriguez, the draft's author, has made 136 commits to the Programmatic Signer repository as of November 9, more than any other contributor, according to its GitHub contributor data. The draft warns that "a failed submission is not a revocation", meaning a signed approval that fails to execute stays valid and can be tried again. The Programmatic Signer repository still read "under construction" on November 9.

What happens next

The next step is technical approval. A bot on the repository lists what the proposal needs to merge: one approval from an Anza team member and one from Jump Crypto's Firedancer team. A commit on November 6 added the timeline, and the draft says the feature "will not be activated on mainnet-beta before 2027-05-05", mainnet-beta being Solana's main network. The Solana Foundation announced a related deprecation plan in October, but its page still says "No date set", and the Foundation's six-month window begins only once a replacement is ready, so the cutoff could slip later than May 2027 even if the proposal is approved.

Custodians would be planning that migration alongside other recent core changes, including the Alpenglow consensus switch, which went live on Solana mainnet in October, and a larger 4,096-byte transaction cap. Solana traded near $86 on November 10, down about 1.7 percent over 24 hours, according to CoinGecko, as the wider market stayed under pressure after more than $1 billion in leveraged positions were liquidated on November 9.

Sources

• Solana Improvement Document SIMD-0723, "Remove Durable Nonces", pull request filed November 5, 2026 by Gabe Rodriguez of Anza (primary source: the draft would require every transaction to use a recent blockhash after activation; System Program instructions to initialize, advance and upgrade nonce accounts would be switched off while withdrawals and authority changes keep working; "will not be activated on mainnet-beta before 2027-05-05"; at least six months to migrate counted from publication on 2026-11-05; requires one approval from an Anza team member and one from a Firedancer team member; Programmatic Signer and Vector named as replacements; "a failed submission is not a revocation")
• CoinDesk, Solana moves to scrap the transaction feature used in the $270 million Drift hack, published November 9, 2026 (secondary reporting: SIMD-0723 filed November 5 by Gabe Rodriguez of Anza; attackers exploited durable nonces to steal at least $270 million from Drift in April; proposal does not mention Drift and cites the 2022 incident that halted mainnet for about 4.5 hours; earliest activation May 5, 2027; Solana Foundation deprecation page says "No date set" and starts the six-month clock only once a replacement is ready; needs sign-off from one Anza engineer and one Firedancer engineer)
• Unchained, Anza's Plan to Kill Solana's Durable Nonces Puts Custodians on a Six-Month Clock, published November 9, 2026 (secondary reporting: durable nonce as a stored value standing in for a recent blockhash, stale after 150 blocks; Nov. 6 commit added the timeline; custodians and exchanges with air-gapped signing singled out; USDC and USDT mint authorities among notable users; Fireblocks' Michael Gutkin in March said 12 months is the minimum feasible at institutional scale without a compatibility bridge; Programmatic Signer and Vector as replacements; Rodriguez made 136 commits to the Programmatic Signer repository; Max Resnick June data showing 3.1 percent of transactions but about 30 percent of priority fees, 555 accounts responsible for 97.5 percent; Drift's $295.7 million figure by its own accounting and its recovery plan calling the durable-nonce attack surface "central to how the April 1 exploit was executed"; Alpenglow consensus switch and 4,096-byte transaction cap as concurrent changes)
• TechInAsia, "Solana weighs cutting feature exploited in $270m DeFi hack", published November 10, 2026 (secondary reporting: proposal filed November 5 to remove durable nonces, which let signed transactions stay valid far beyond the usual roughly 30-second window; attackers held pre-signed transactions for more than a week before draining at least $270 million from Drift on April 1; Drift later attributed the attack to a North Korean state-affiliated group)

This article is news reporting and is not investment advice.