Solana Is Killing the Feature Behind the $270M Drift Hack: 5 Numbers That Decide What Happens Next
Solana developers filed SIMD-0723 to retire durable nonces — the feature North Korea-linked hackers used to steal $270M from Drift. Only 3% of Solana traffic used it, but it generated 30% of priority fees. Here's what changes before May 5, 2027.
Solana is about to delete the feature that let hackers steal more than $270 million. On November 5, 2026, developers filed proposal SIMD-0723 to retire durable nonces — the mechanism that lets a signed transaction sit unsent for weeks, which North Korea-linked attackers used to drain Drift in April. The change would not take effect before May 5, 2027, but the numbers explain why Solana is acting now: durable nonce transactions made up just 3% of network traffic in June, yet they generated 30% of all priority fees — and only 555 accounts were responsible for 97.5% of them.
For most Solana holders, nothing changes on day one: your SOL is not at risk and no funds move because of this proposal. But for the custodians and exchanges that sign transactions offline, the next six months bring a forced rebuild of how they move coins. Here is what SIMD-0723 does, how the Drift hack worked, and the five numbers that decide what happens next.
What Just Happened: SIMD-0723 in Plain English
Filed on November 5 by Gabe Rodriguez of Anza — the firm behind Solana's main validator software — the proposal would require every Solana transaction to use a recent blockhash after activation. Today, most Solana transactions expire quickly because they reference a recent blockhash, which goes stale within about two minutes. Durable nonces are the exception: they let a transaction reference a special on-chain nonce account instead, keeping the signed transaction valid indefinitely, or at least until the nonce is advanced.
SIMD-0723 would remove that exception entirely: once it activates, no transaction could stay valid for weeks. The draft puts the earliest activation at May 5, 2027, giving users at least six months to migrate. The Foundation's own page still says "No date set", which could push the cutoff later. The proposal is still a draft: before it can be merged, it needs sign-off from at least one engineer at Anza and one at Firedancer, the rival validator software built by Jump.
Notably, the proposal does not mention Drift by name. It builds its case on years of bugs, including a 2022 incident in which a failed transaction was processed through both the blockhash and nonce paths, halting the mainnet for about 4.5 hours. But nobody doubts the real trigger: the Drift exploit of April 1, 2026, was the largest hack in Solana's history — and durable nonces made it possible.
What Are Durable Nonces — and Why Did Solana Build Them?
Durable nonces exist because of a problem institutions face. A normal Solana transaction references a recent blockhash, and if it is not submitted within roughly two minutes, it becomes invalid. That is a safety feature — if someone intercepts your signed transaction, they cannot sit on it and submit it weeks later when prices have moved.
But that short expiry creates a problem for custodians and exchanges that sign transactions on air-gapped computers — machines deliberately kept offline so private keys can never be stolen over the internet. The signed transaction has to be carried from the offline machine to an online one, and two minutes is not always enough. Durable nonces solved that: sign once, and the transaction stays valid for as long as the nonce account remains untouched. Custodians could sign in advance, store the transaction, and submit it whenever they were ready.
That convenience is what made the feature dangerous: a signed transaction that never expires is a loaded weapon sitting in a drawer. If an attacker obtains one — or tricks someone into signing one — they can wait for the perfect moment to fire it. In the Drift case, that is precisely what happened.
The $270 Million Lesson: How the Drift Hack Actually Worked
On April 1, 2026, attackers drained at least $270 million from Drift, a prominent decentralized exchange on Solana. Drift's own accounting, published on April 16, put the theft at about $295.7 million. The attackers have been linked to North Korean state-affiliated actors, with research pointing to the group tracked as UNC4736, also associated with the Lazarus group.
The attack combined two ingredients: pre-signed durable nonce transactions — signed in advance and still valid because durable nonces do not expire — and compromised multisig approvals, likely obtained through social engineering or transaction misrepresentation, where signers were shown one thing and approved another. The pre-signed transactions let the attackers wait more than a week before executing the theft. Without durable nonces, the stolen signatures would have expired within minutes and the attack would have failed.
The aftermath dragged on for months. In October, the hacker moved $61 million in ETH to Tornado Cash while still holding around $194 million, and Tether pledged $147.5 million toward victims — a pledge that, as our earlier coverage explained, had still not reached victims months later, with DFX token claims trading at around one cent on the dollar. Drift has since resumed operations under a new name, Velocity.
| Date | What happened |
|---|---|
| April 1, 2026 | Attackers drain at least $270 million from Drift using pre-signed durable nonce transactions |
| April 16, 2026 | Drift's accounting puts the theft at about $295.7 million; attackers linked to North Korea's UNC4736/Lazarus network |
| October 2026 | Solana Foundation announces a deprecation plan for durable nonces; hacker moves $61M in ETH to Tornado Cash |
| November 5, 2026 | Anza's Gabe Rodriguez files draft proposal SIMD-0723 to retire durable nonces entirely |
| May 5, 2027 | Earliest possible activation date on mainnet-beta — at least six months of migration time |
The lesson is blunt: a feature used by a tiny minority of accounts, which created the single worst security incident in the network's history, is not worth keeping.
5 Numbers That Decide What Happens Next
SIMD-0723 has five numbers that matter more than the rest. Together they explain why Solana is willing to force its biggest custodians to rebuild their signing infrastructure — and why the change is unlikely to hurt ordinary users at all.
| # | The number | Why it matters |
|---|---|---|
| 1 | $270–$295.7 million stolen from Drift | The largest hack in Solana history, executed with pre-signed transactions that stayed valid for over a week |
| 2 | 3% of traffic, 30% of priority fees | A tiny share of June traffic but nearly a third of all priority fees |
| 3 | 555 accounts, 97.5% of durable nonce transactions | Almost all durable nonce use came from 555 accounts — an institutional feature, not a retail one |
| 4 | 4.5 hours of mainnet downtime in 2022 | A failed transaction processed through both the blockhash and nonce paths halted Solana — the feature has caused outages, not just hacks |
| 5 | May 5, 2027 — earliest activation | At least six months to migrate, and the Foundation's conditions could push the date later; nothing changes for users before then |
The second and third numbers are the most revealing. In June, durable nonce transactions were just 3% of traffic, and 555 accounts were responsible for 97.5% of them. The feature exists almost entirely for custodians and exchanges that sign offline — retail users can lose durable nonces and never notice. The blast radius of removing it is small, while the security benefit is enormous.
The 30% of priority fees figure cuts the other way: durable nonce transactions paid far more in fees than their share of traffic. Validators will feel a small revenue effect when the feature disappears — but Solana's developers have decided that is a fair price for removing the mechanism behind a $270 million theft.
Who Has to Change — and Who Doesn't
If you hold SOL in a wallet like Phantom or Solflare, or on an exchange, this proposal almost certainly does not affect you. Retail wallets do not use durable nonces; they sign and submit transactions in seconds, well within the normal blockhash window. Your funds are not moving and there is nothing you need to migrate.
The organizations that do have to change built their security around offline signing: custodians holding crypto for institutions, exchanges keeping customer funds in cold storage, and any service signing on air-gapped machines. For them, durable nonces were load-bearing infrastructure. The proposal names two replacements — Anza's Programmatic Signer and Blueshift's Vector — which move signature verification and replay protection into the protocol layer, so custodians can keep signing offline.
That migration is not trivial: the replacements carry different operational risks, including failed transaction authorizations if the new signing flow is misconfigured. Custodians must rebuild, test, and audit their signing pipelines — which is why the proposal gives them at least six months, and why the Foundation's conditions could push the real cutoff well past May 5, 2027.
It is worth noting what this change does not do. It does not make Solana's multisig wallets safer on their own — the Drift attackers also needed compromised multisig approvals, and social engineering remains a threat no protocol change can remove. It does not refund the $270 million. What it does is close one specific door: the ability to bank a signed transaction for weeks and fire it at the perfect moment.
What Most People Get Wrong About This Change
The first reactions online have mixed the real story with several wrong ones. Here are the myths worth correcting:
Myth 1: Solana is removing offline signing. No. Offline signing is moving to new plumbing: Anza's Programmatic Signer and Blueshift's Vector preserve signing on air-gapped machines. What disappears is the mechanism of a transaction that stays valid indefinitely.
Myth 2: This means SOL's price will crash. There is no direct link between a protocol security upgrade and the SOL price. SOL's current weakness — down about 8.6% in a week to around $86 — is driven by the broader market sell-off, not by this proposal.
Myth 3: The hack was a bug in Solana itself. The Drift exploit was not a bug in Solana's code. It was stolen pre-signed transactions plus compromised multisig approvals at Drift — an application-level failure that used a protocol feature exactly as designed. The fix is a protocol change rather than a patch because the feature worked as intended, and as intended it was dangerous.
Myth 4: Durable nonces disappear tomorrow. They do not. The earliest activation date is May 5, 2027, the Foundation's migration conditions could delay it further, and the proposal still needs approval from engineers at Anza and Firedancer before it is merged.
Myth 5: Only Drift was affected. Drift was the victim, but the risk was network-wide: any protocol or custodian using durable nonces carried the same exposure. The 2022 mainnet halt showed the feature could also break the network itself.
What It Means for SOL at $86
The proposal arrives while SOL is under pressure. Solana traded near $86.48 on Monday morning, down about 2.9% in 24 hours and roughly 8.6% over the past week, as the whole market sold off: Bitcoin slipped below $75,000, Ethereum broke below $2,170, and XRP fell hardest of the majors, down more than 12% in a week. Solana's RSI sat near 30.6 — close to oversold — and SOL traded below its 200-day average near $89.
SIMD-0723 is not a price catalyst in either direction this week. It is a slow-burn governance and security story that plays out over six months, not a headline that moves SOL 10% in a day. But the levels are clear, and the table below lays out the three scenarios traders are watching — levels to watch, not predictions:
| Scenario | Trigger | SOL level |
|---|---|---|
| Bullish | SOL reclaims its 200-day average and the market stabilizes after Tuesday's CPI report | $89, then $98 resistance |
| Base case | SOL chops sideways between support and the 200-day average while the market waits on CPI and PPI data | $84–$89 range |
| Bearish | SOL loses $84 and the broader sell-off deepens | $84 breaks, $80 in focus |
Two events decide which scenario plays out: Tuesday's October CPI report, due November 10 — a cooler reading would ease pressure on risk assets, a hot one would deepen the sell-off — and whether SOL can hold $84. A break below it opens the door to $80, while a reclaim of the 200-day average near $89 would signal the worst of the weekly slide is over.
Longer term, the decision fits a pattern that should matter to SOL holders more than any single week of price action. Solana spent 2026 absorbing institutional adoption — tokenized funds, ETF filings, and a growing share of stablecoin and real-world-asset activity — while carrying the reputational cost of the Drift hack. Retiring the feature behind it is the network choosing security over convenience for its largest users. For a full comparison of how Solana is holding up against its rivals in this sell-off, see our breakdown of Bitcoin vs Ethereum vs Solana vs XRP, and for the price levels in detail, our Solana price prediction for November 2026.
SOL Holder Checklist: 5 Things to Do Now
This is one of the rare crypto security stories where ordinary holders need to do almost nothing. But the Drift hack is a reminder that the biggest losses in crypto usually come from the basics:
- Check where your SOL actually sits, and how it is secured. If your SOL is in a hardware wallet or a reputable exchange, this change does not touch you. If you use a custodian you have not reviewed in a year, ask how it signs transactions. Our guide to storing crypto safely in 2026 covers the same principles for any coin.
- Never approve a transaction you have not read in full. The Drift attackers relied on compromised multisig approvals — signers who approved something different from what they thought they were signing. Blind-signing is the most dangerous habit in crypto. If a signing request looks wrong, stop.
- Watch the May 5, 2027 date, not the headlines. The earliest activation is more than six months away, and the Foundation's conditions could push it later. Set a reminder for April 2027 to check whether your custodian or exchange has migrated.
- Do not move funds because of this proposal. There is no reason to unstake, sell, or transfer SOL because durable nonces are being retired. Panic moves during a sell-off turn a temporary dip into a permanent loss.
- Use the dip to learn the network you hold. If you own SOL but could not have explained what a durable nonce was before today, close the gap with our beginner's guide to buying Solana, which covers wallets, exchanges, and the basics of holding SOL safely.
FAQs
What are durable nonces on Solana?
Durable nonces are a Solana transaction feature that lets a signed transaction stay valid indefinitely instead of expiring within about two minutes like a normal transaction. They exist so custodians and exchanges can sign on offline, air-gapped computers and submit later. Proposal SIMD-0723 would retire the feature entirely, no earlier than May 5, 2027.
How much was stolen in the Drift hack?
At least $270 million was stolen from Drift on April 1, 2026, with Drift's own accounting putting the figure at about $295.7 million. The attackers, linked to the North Korean UNC4736/Lazarus network, used pre-signed durable nonce transactions plus compromised multisig approvals, and waited more than a week before executing the theft.
Will retiring durable nonces affect my SOL or my wallet?
No. Retail wallets such as Phantom and Solflare do not use durable nonces — they sign and submit transactions within seconds. The change affects custodians and exchanges that sign offline. Ordinary SOL holders do not need to do anything.
When will durable nonces actually be removed?
Not before May 5, 2027, according to the draft, which gives users at least six months to migrate from its November 5, 2026 publication date. The Foundation's conditions could push the date later, and the proposal still needs approval from engineers at Anza and Firedancer before it is merged.
What replaces durable nonces for custodians?
The proposal names Anza's Programmatic Signer and Blueshift's Vector. Both move signature verification and replay protection into the protocol layer, preserving offline signing without a transaction that stays valid forever. Custodians will need to rebuild and audit their signing pipelines.
Is SOL a good buy after this news?
It is a long-term security positive, not a short-term price catalyst. SOL traded near $86 on November 9, down about 8.6% in a week, below its 200-day average near $89. The near-term direction depends on Tuesday's CPI report and whether $84 support holds. This article is not investment advice — see our Solana price prediction for November 2026 for the full breakdown.
Conclusion
Solana's decision to retire durable nonces is the network learning the most expensive lesson in its history — in public. A feature used by just 555 accounts, generating 30% of priority fees from 3% of traffic, gave North Korea-linked hackers the one thing they needed to steal $270 million: time. A signed transaction that never expires is a risk that never expires either.
The change will not happen overnight: the earliest activation is May 5, 2027, the proposal still needs engineering sign-off, and custodians face months of rebuilding. But the direction is set — Solana is removing the mechanism behind its worst hack rather than patching around it. For SOL holders, that is a reason for cautious confidence, because it is the kind of decision that determines whether institutions trust the network in 2027.
Watch the migration, not the headlines: if custodians move cleanly to the new signing tools before the deadline, the Drift hack will end up as the incident that made Solana safer. Either way, the feature that let a signed transaction sit in a drawer for weeks is on its way out. For context, read our earlier coverage of the Drift hack fund movements and the Avalanche vs Solana comparison — and if you are new to the network, our guide on how to buy Solana in 2026 is the place to start.
Sources: CoinDesk, Crypto Briefing, Traders Union, KuCoin News. Market data as of November 9, 2026. Not investment advice.
