Solana developers aim to close a security loophole linked to the $270 million Drift hack by retiring durable nonces by May 2027, forcing custodians to overhaul offline signing workflows.
Solana developers filed SIMD-0723 on Nov. 5, 2026 to retire durable nonces, the feature exploited in the April Drift hack that drained at least $270 million. Removing a known attack vector supports network security, but the change only takes effect no earlier than May 5, 2027, and custodians face migration risks, so the near-term price effect is limited and two-sided.
Solana developers filed proposal SIMD-0723 on Nov. 5, 2026, to retire the 'durable nonces' feature, which allows signed transactions to remain valid indefinitely. This mechanism was exploited in an April 2026 attack that drained at least $270 million from the Drift protocol. The change is scheduled for no earlier than May 5, 2027, requiring custodians and exchanges that rely on offline signing to migrate to new onchain programs.
The proposal argues it closes the loophole used in the April Drift hack, where pre-signed transactions sat for over a week before being used to steal at least $270 million, though it cites years of bugs rather than the hack itself as its justification.
Not before May 5, 2027, and the Solana Foundation's migration requirements could push the deadline later since its deprecation page still says 'No date set'.