Solana moves to scrap the transaction feature used in the $270 million Drift hack

Solana’s developers want to retire a feature that lets a signed transaction sit unsent for weeks — the mechanism that attackers relied on to drain at least $270 million from trading protocol Drift in April.

Every normal Solana transaction carries a stamp tied to a recent block, called a blockhash, which makes it expire after about 30 seconds now that the network runs 200-millisecond blocks. A mechanism known as durable nonce swaps that stamp for one that never goes stale, so a transaction signed today can still go through next month.

Such a delay is required by custodians and exchanges as their approvals happen on air-gapped machines — a term for computers kept off the internet — where getting a signature out to the network can take longer than 30 seconds.

It also suited the Drift attackers, who got approvals signed in advance and let those transactions sit for more than a week before using them to empty the trading platform on April 1. Drift later blamed the attack on a North Korean state-affiliated group.

The proposal to remove the feature, SIMD-0723, was filed Nov. 5 by Gabe Rodriguez of Anza, the firm behind Solana’s main validator software.

“After activation, every transaction needs a recent blockhash,” it says. The proposal does not mention Drift, but instead builds its case on years of bugs, including a 2022 incident in which “a failed transaction was processed through both the blockhash and nonce paths, halting mainnet for about 4.5 hours.”

The draft also puts the first date on a plan the Solana Foundation announced in October.

“The feature will not be activated on mainnet-beta before 2027-05-05,” it says, giving users “at least six months to migrate, counted from this proposal’s publication on 2026-11-05.” The Foundation’s own deprecation page still says “No date set” and starts the six-month clock only once a replacement is ready, which could push the cutoff later.

What changes

A small group would feel most of the change. Durable nonce transactions made up about 3% of Solana’s traffic in one June measuring period but paid 30% of all priority fees, the tips users add to get processed first.

Just 555 accounts sent 97.5% of them, according to data from researcher Max Resnick.

Resnick’s post does not say who runs those accounts, and it describes the feature being “coopted for durable nonce spam.” The proposal names custodians as a separate affected group.

“This includes custodians and exchanges that use air-gapped signing, where approvals take longer than that window,” it saod.

Their replacement would be an onchain program that checks an offline signature, with Anza’s Programmatic Signer and Blueshift’s Vector named as options. Those programs bring a risk of their own, however, and the draft warns that “a failed execution can leave an authorization usable, so a failed submission is not a revocation.” A custody desk that sees a transfer fail could not assume the approval behind it had died.

The proposal still needs sign-off from at least one engineer at Anza and one at Firedancer, the rival validator software built by Jump, before it can be merged.