Solana developers are moving to eliminate a technical feature that served as the primary entry point for a $270 million exploit earlier this year. The feature, known as durable nonces, has been a part of the network for years, but its ability to keep transactions valid indefinitely created a window of opportunity for attackers to drain the Drift trading protocol in April.
A formal proposal to retire the feature was filed on November 5, 2026. If approved, the shift will force major exchanges and custodians to overhaul how they handle security for large-scale coin movements. While the change aims to harden the network against similar exploits, it removes a tool that a small but high-paying group of users relies on to manage offline signatures.
The Drift exploit
In April, attackers linked to North Korean state-affiliated groups targeted Drift Protocol, a decentralized trading platform. They managed to walk away with at least $270 million [1]. The theft did not rely on a simple flash loan or a typical smart contract bug. Instead, the attackers used durable nonces to bypass the usual time limits placed on Solana transactions.
Most transactions on the network are tied to a recent blockhash. This acts as a timestamp. Because Solana now processes blocks every 200 milliseconds, these standard transactions expire after roughly 30 seconds [1]. If a transaction is not processed within that window, it becomes invalid. This prevents old signatures from being reused later if network conditions change.
The Drift attackers took a different path. They obtained signed approvals in advance and allowed those transactions to sit idle for more than a week [1]. Because these transactions used the durable nonce mechanism, they did not expire. On April 1, the attackers broadcast the pre-signed transactions to empty the platform [1]. The ability for a signed instruction to remain valid for days or weeks is exactly what the new proposal seeks to end.
Technical mechanics
The core of the issue lies in how Solana handles transaction expiration. Under normal circumstances, every transaction must carry a stamp from a recent block. This ensures that the network state at the time of signing is relatively close to the state at the time of execution.
Durable nonces were designed to solve a specific problem for users who cannot broadcast a transaction immediately after signing it. This is a common requirement for custodians and large exchanges that use air-gapped signing. In these setups, the computer that holds the private keys is never connected to the internet. A human must manually move the transaction data from the offline machine to an online one. If that process takes longer than 30 seconds, a standard Solana transaction would expire before it ever reached the network.
Durable nonces swap the standard blockhash for a unique value stored in a specific account on the blockchain. As long as that account remains unchanged, the signed transaction stays valid. This effectively gives a transaction an infinite shelf life until it is either executed or the nonce is manually rotated. While this provides flexibility for high-security operations, it also removes the safety net of expiration that protects most users from delayed exploits.
The proposal timeline
The effort to remove this feature is being led by Gabe Rodriguez, an engineer at Anza. Anza is the firm responsible for maintaining the primary validator software used by the Solana network. Rodriguez filed the proposal, known as SIMD-0723, on November 5, 2026 [1].
The proposal argues that durable nonces have been a source of bugs and instability for years. Beyond the Drift hack, the document cites a 2022 incident where a failed transaction was processed through both the standard blockhash path and the nonce path simultaneously. That error caused the Solana mainnet to halt for approximately 4.5 hours [1].
Under the current draft, the feature would not be deactivated on the mainnet-beta before May 5, 2027 [1]. This timeline is intended to give users at least six months to migrate their systems. However, the Solana Foundation has indicated that the clock might not start until a viable replacement for durable nonces is fully ready. If a replacement is delayed, the final cutoff date could move further into 2027.
For the proposal to move forward, it requires technical sign-off from at least two key parties. One engineer from Anza and one engineer from the Firedancer team must approve the changes before they can be merged into the network code [1]. Firedancer is the independent validator client being developed by Jump Crypto, and its approval is a standard requirement for major protocol changes.
The affected users
While durable nonces are a niche feature, they represent a significant portion of the network's economic activity. Data from researcher Max Resnick shows that durable nonce transactions accounted for only about 3% of Solana’s traffic during a measuring period in June [1]. However, those transactions were responsible for 30% of all priority fees paid to validators during that same timeframe [1].
Priority fees are the tips users add to their transactions to ensure they are processed quickly. The fact that 3% of traffic pays 30% of the fees suggests that the users of durable nonces are often large institutional players or automated systems that value speed and reliability over cost.
The data also shows that this usage is highly concentrated. Only 555 individual accounts were responsible for 97.5% of all durable nonce transactions [1]. Some of this activity is attributed to "durable nonce spam," where users exploit the feature to flood the network with persistent transactions. The rest of the group consists primarily of the custodians and exchanges that rely on air-gapped signing. When the feature is retired, these 555 accounts will have to find a new way to operate.
Future alternatives
The retirement of durable nonces does not mean that air-gapped signing will become impossible on Solana. Instead, developers are being pushed toward using on-chain programs to handle signatures. The proposal suggests two primary options: Anza’s Programmatic Signer and Blueshift’s Vector [1].
These programs act as intermediaries. Instead of a transaction being valid on its own, it is sent to a program that checks an offline signature against specific rules stored on the blockchain. This allows for a longer signing window without leaving the network vulnerable to the same types of account-locking bugs associated with nonces.
However, these new methods come with their own set of risks. The draft proposal warns that a failed execution in these new programs can leave an authorization usable [1]. In the old system, if a transaction failed, the nonce was usually consumed or the blockhash expired. With the proposed replacements, a failed submission is not the same as a revocation. A custody desk that sees a transfer fail cannot automatically assume the approval is dead. They may need to take additional steps to ensure the signature cannot be reused.
The Solana Foundation previously announced a plan to deprecate the feature in October, but SIMD-0723 provides the first concrete dates for the transition. The proposal is currently awaiting technical review by the Anza and Firedancer teams.
Sources
1. CoinDesk, Solana Moves to Scrap the Transaction Feature Used in the $270 Million Drift Hack, https://www.coindesk.com/tech/2026/11/09/solana-moves-to-scrap-the-transaction-feature-used-in-the-usd270-million-drift-hack
Charts and the full source list: https://amk.news/article/solana-to-scrap-transaction-feature-after-270m-drift-hack