Solana Developers Propose Retiring Durable Nonces After Drift Hack

Solana developers have proposed retiring durable nonces, the transaction feature that attackers exploited to drain at least $270 million from the Drift protocol in an April 1 exploit, according to Crypto Briefing.

Durable nonces let signed transactions stay valid indefinitely, unlike ordinary Solana transactions, which expire after about 30 seconds on a network that produces blocks every 200 milliseconds. Crypto Briefing reports that research findings tied the Drift breach to a six-month social engineering effort directed at two members of the protocol's Security Council, culminating in pre-signed transactions that handed attackers admin control and emptied reserves within minutes. Losses were put at roughly $270 million to $285 million, more than 50% of the protocol's total value locked, the outlet said.

The memecoin morning brief

Yesterday's top memecoin movers, launchpad numbers and the stories that matter. Free, every morning.

Email address

Get it free

Website

Privacy policy

The outlet reported that attackers have been tied to the group tracked as UNC4736, also linked to Lazarus, but it characterized this connection as probable rather than verified. The Solana Foundation, in turn, proposed shifting toward onchain programmatic signer alternatives that would build signature verification and replay protection directly into the protocol layer. No fixed date for removing durable nonces has been set, with the timeline hinging on pending audits and a migration window, Crypto Briefing said. The outlet also noted that Drift has resumed operations under the name Velocity and launched a new token, DFX, meant to support affected users, while the proposed signer alternatives still carry unresolved risks that remain unconfirmed.