Solana to retire durable nonces after $270M Drift hack
4.5 Tech Solana plans to retire durable nonces after the $270M Drift hack, shifting delayed-signature safeguards to onchain programs. The change, not yet approved, is targeted for May 2027 or later.
Solana developers have proposed retiring the durable nonces feature, which lets signed transactions remain valid beyond the standard 30-second blockhash window. This follows the April 2026 Drift Protocol exploit, where attackers used durable nonces to drain at least $270 million by executing pre-approved transactions long after signatures were obtained. The proposal, SIMD-0723, would require all transactions to use recent blockhashes and disable nonce accounts, shifting delayed-signature safeguards to onchain programs. While not yet approved or scheduled for immediate activation, durable nonces will continue to function until a replacement is audited and deployed, with a migration window expected. The draft notes that replacement systems could leave failed transaction approvals valid, raising new security considerations for custodians and exchanges. Deprecation is planned for no earlier than May 2027, giving stakeholders time to adapt their offline-signing processes.
