North Korean hackers exploit Solana's durable nonce for $270M heist

Solana Developers Propose Eliminating Durable Nonce Mechanism

Solana developers have put forth a proposal, SIMD-0723, aiming to deprecate the durable nonce mechanism, which allows signed transactions to remain valid indefinitely. This feature was exploited in April to drain at least $270 million from the Drift trading platform. The proposed change is slated for implementation on the mainnet no earlier than May 5, 2027.

End of an Era for “Set-It-and-Forget-It” Transactions

Developers are formally proposing to phase out a feature on Solana that allows signed transactions to be held for extended periods before submission. This mechanism, known as durable nonce, was utilized by attackers in April. They reportedly obtained signatures in advance, waited for over a week, and then proceeded to drain funds from the Drift trading platform, resulting in losses of at least $270 million.

The proposal, identified as SIMD-0723, was submitted on November 5 by Gabe Rodriguez, an engineer at Anza, a team responsible for maintaining Solana’s core validator software. The proposal states that “upon activation, every transaction will require a recent blockhash,” effectively replacing the durable nonce’s “ever-valid timestamp” with a blockhash-based validation. While the proposal does not explicitly name Drift, it cites historical incidents to justify the change, including a 2022 event where a failed transaction simultaneously traversed both blockhash and nonce paths, causing a network outage of approximately 4.5 hours.

Understanding Transaction Validation on Solana

To grasp the implications of this change, it’s essential to understand how standard transactions operate. Each Solana transaction is associated with a blockhash tied to a recent block. Given Solana’s block production time of approximately 200 milliseconds, this timestamp typically expires within 30 seconds. The durable nonce mechanism’s purpose was to convert these time-sensitive timestamps into a perpetual version, allowing a transaction signed today to remain valid next month.

This delayed execution capability is particularly relevant for custodians and exchanges that employ offline signing. Such systems, often referred to as “air-gapped,” involve signing machines that are completely disconnected from the internet. The process of submitting a signed transaction to the network often exceeds the standard 30-second window. The proposal specifically addresses this group, stating, “This includes custodians and exchanges that utilize air-gapped signing, whose approval processes exceed this window.”

Alternative Solutions and Their Risks

The proposed alternative involves on-chain programmatically verifying offline signatures. The proposal highlights two options: Anza’s Programmatic Signer and Blueshift’s Vector. However, this path introduces new risks. The draft warns that “a single failed execution could leave an authorization still usable, meaning a failed submission does not equate to a revocation.” In simpler terms, if a custodian’s transfer fails, the underlying authorization cannot be assumed to be invalidated.

Concentrated Impact and Exploitation

While the scope of the impact appears limited, it is highly concentrated. According to data shared by researcher Max Resnick in community discussions, during a measurement period in June, durable nonce transactions accounted for only about 3% of Solana’s total transaction volume but were responsible for 30% of the network’s priority fees. Resnick did not specify who operated these accounts but described the feature as being “abused for durable nonce spam.”

A Clear Timeline Emerges

This draft proposal provides the first concrete date for a plan announced by the Solana Foundation in October. The proposal states that the feature “will not launch on mainnet-beta earlier than 2027-05-05” and grants users a migration period of “at least six months from the announcement of this proposal on 2026-11-05.” However, the Foundation’s own deprecation page currently lists “no date set,” and the six-month countdown is contingent on the readiness of alternative solutions, suggesting the actual switch-over date could be further delayed.

Technical Hurdles and Validator Ecosystem

The proposal still requires final technical approval. It must be signed off by one engineer each from Anza and Firedancer, the competing validator software developed by Jump. This means that even with broad community consensus, the timeline hinges on the implementation progress of these two distinct validator clients.

The Original Intent and Evolving Threats

The durable nonce mechanism was initially designed to address a practical challenge: the inherently slower signature process for institutional cold wallets compared to the 30-second window. However, this convenience also became a source of vulnerability. When signatures can be indefinitely deferred, defenders lose the final safeguard of transaction expiration. The losses incurred by Drift in April represent the tangible cost of this safeguard’s absence. It’s worth noting a discrepancy in reported figures: while CoinDesk reported losses of $285 million in April based on official statements, the proposal document and foreign media reports cite at least $270 million. Both figures are valid and can be cross-referenced with earlier investigative reports.

Implications for Exchanges and Custodians

For local market participants, this development has significant implications for exchanges and custodians. Local operators utilizing offline signing processes will need to revise their assumptions about signature validity within the next two years. They can no longer rely on the intuitive notion that “a failed transaction equals a failed authorization.” From a regulatory perspective, this also provides a concrete example: as the protocol layer actively tightens a convenient but insecure design, compliance costs will shift to intermediary institutions.

Key Points for Future Observation

Two key aspects will be closely monitored. First, when the Solana Foundation updates its deprecation page from “no date set” to a definitive timeline, this will determine whether May 2027 is a hard deadline or a soft target. Second, whether Anza and Jump’s Firedancer provide synchronized implementations. If only one client supports the change, it could lead to a split within the validator ecosystem.