Solana plans to remove durable nonces, the transaction mechanism abused in the April attack on Drift Protocol. The Solana Foundation's published migration guidance describes a replacement built around onchain signing programs, with removal expected roughly six months after a suitable replacement is ready.
As of November 9, 2026, durable nonces remain valid on mainnet and no removal date has been set. The change preserves offline signing while moving its special transaction handling out of the validator runtime.
Published loss estimates for the attack commonly described as the $270 million Drift hack also run higher. TRM Labs estimated approximately $285 million in its April investigation; Drift's April 16 asset breakdown subsequently listed $295.7 million withdrawn. Those figures describe different published assessments of the same incident.
Delayed signatures became administrative control
Durable nonces solve a practical problem. Ordinary Solana transactions have a recent blockhash that expires. Institutions signing on disconnected devices, or collecting approvals through slower internal processes, need more time.
Solana's transaction documentation explains that a durable nonce replaces that recent blockhash with a stored value. The transaction can then be signed offline and submitted later. After successful nonce validation, the nonce advances; even if execution subsequently fails, the advanced nonce and transaction fee remain committed to prevent replay.
That extended signing lifetime became part of the Drift attack.
According to TRM Labs, attackers created durable nonce accounts between March 23 and March 30 and induced Security Council members to sign transactions containing concealed administrative authorizations. Drift's council had a two-of-five approval threshold and no timelock following a March 27 migration.
On April 1, the attackers submitted the prepared transactions, took administrative control, admitted fictitious collateral and raised withdrawal limits. TRM counted 31 withdrawals over roughly 12 minutes.
Authorization and execution can occur far apart: a signature collected earlier can remain dangerous after the signing session ends. Removing the runtime mechanism addresses one technical component of that process; transaction review still determines whether an administrator approves the intended action.
Offline approval survives the redesign
The replacement discussion predates the Drift attack. Solana's nonce replacement meta-proposal began in January 2026, with requirements that included offline preparation, protection against replay and validity beyond the ordinary blockhash window.
Its proposed CPI Passthrough approach places signature verification in a program. A cold key approves instructions offline. An online fee payer submits that approval inside an ordinary transaction, and the program verifies it before executing the instructions through cross-program invocation.
Account authorities would move to program-derived addresses controlled through this signing arrangement. The validator would process an ordinary transaction rather than apply special durable nonce rules.
The proposal makes the architectural tradeoff explicit: removing nonce handling from validators requires new offline tooling and changes to account authorities.
That work prevents an immediate switch. Exchanges and custodians need the replacement to preserve their approval processes, including the separation between the key authorizing an action and the infrastructure submitting it.
The Foundation identifies Anza's Programmatic Signer and Blueshift's Vector as replacement candidates. Its guidance says ordinary transactions are unaffected.
Drift's response reaches beyond transaction expiry
Drift's April 16 recovery update described its own plan to disable durable nonces for all signers. That commitment was part of a wider administrative security redesign.
The proposed framework required dedicated signing devices and independent verification of transaction contents outside the primary signing interface. Critical administrative actions would receive timelocks and alerts, creating an interval in which an anomalous proposal could be detected before execution.
Drift also made relaunch contingent on independent audits by Ottersec and Asymmetric, covering code changes and operational security.
These controls address different points in the attack sequence. Independent verification tests what the signer is approving. A timelock separates approval from execution. Disabling durable nonces restricts the transaction mechanism available to those signers.
For depositors, the relevant risk extends to the people authorized to change a protocol's rules. In this incident, control over administrative permissions let the attacker alter collateral acceptance and withdrawal limits. Reviewing trading code alone would leave that authority outside the assessment.
Overview
Solana's planned durable nonce removal moves offline signing into onchain programs. Existing nonce transactions remain usable while replacements are developed and users prepare to move.
The Drift attack shows the stakes of delayed authorization: previously collected signatures helped attackers obtain administrative powers and withdraw protocol assets. Drift's subsequent security plan paired nonce restrictions with independent transaction checks and delayed execution.
The protocol migration carries its own implementation burden. Signing tools and account authorities must change before removal. The Foundation's published timetable remains approximately six months after a replacement is ready, with no fixed activation date.
