Solana Considers Cutting Feature Exploited in $270M DeFi Hack

Solana developers are weighing a proposal to remove a built-in feature that attackers exploited to drain at least $270 million from a major DeFi protocol earlier this year. The proposal, filed on November 5, 2026, would permanently cut “durable nonces” from the Solana network, a change that could reshape how custodians and large institutions interact with the blockchain.

Why Solana is weighing a change to the exploited feature

The proposal is called SIMD-0723. It was filed by Gabe Rodriguez of Anza, one of the core development teams building Solana’s software. The proposal targets durable nonces, a feature that allows a signed transaction to remain valid indefinitely rather than expiring after a short window. For related coverage, see Formation Securities Plans Solana Tokenized Stock Trading.

In plain terms: normally when you sign a Solana transaction, it has a short expiry. With a durable nonce, that signed transaction can sit unused for months and still work when submitted. That convenience is also the risk. Context on this theme: How to File Crypto Taxes Before Year-End 2026: A Beginner Guide.

As of November 9, 2026, the proposal had zero approvals. It requires sign-off from at least one engineer each at Anza and Firedancer, the client built by Jump Crypto, according to Unchained Crypto. The earliest the change could reach Solana’s mainnet is May 5, 2027.

Despite being a niche feature, durable nonces punch well above their weight in network economics. They account for roughly 3% of Solana’s transaction volume but about 30% of all priority fees, according to research by Max Resnick cited in CoinDesk. Just 555 accounts sent 97.5% of all durable nonce transactions, which means a tiny group of institutional users generate a disproportionate share of Solana’s fee revenue.

How the $270m DeFi hack put the feature in focus

On April 1, 2026, Drift Protocol, a decentralized exchange built on Solana, was drained of at least $270 million. The attackers did not exploit a code bug in the traditional sense. Instead, they exploited the durable nonce feature itself, according to CoinDesk’s original reporting on the incident.

The attack required patience. According to Crypto Briefing, the attackers spent six months posing as a quant trading firm in a social engineering campaign. That access allowed them to obtain pre-signed admin transactions from Drift’s Security Council. Because those transactions used durable nonces, they remained valid long after they were signed. The attackers then submitted them more than a week later to drain the protocol.

The exploit is suspected to be the work of a North Korean state-affiliated group, specifically UNC4736, also known as the Lazarus Group, according to Crypto Briefing. More than $230 million in USDC was bridged to Ethereum via Circle’s CCTP across over 100 transactions after the hack. Over 50% of Drift’s total value locked was wiped out.

Coinlineup previously reported that a Solana trading-bot incident drained nearly $1 million from 49 wallets.

What removing the feature could mean for Solana users and institutions

The proposal’s removal would create real friction for large Solana users. The USDC and USDT mint authorities, which manage the creation of the two largest stablecoins on the network, are among the notable institutional users of durable nonces who would need to migrate, Unchained Crypto reported. These are organizations that use pre-signed transactions for treasury management and cold-storage operations, where human approval of every transaction in real time is not practical.

Michael Gutkin of Fireblocks, a major institutional crypto custody provider, addressed the timeline directly. “Durable nonce deprecation seems like the right direction,” Gutkin said. “If accounts had to be migrated with no compatibility bridge, 12 months is the minimum we believe is feasible at institutional scale.”

The proposal’s minimum activation date of May 5, 2027 gives roughly six months from the November 5 filing for affected parties to prepare, which Fireblocks considers tight but feasible with a compatibility bridge in place.

Two replacements have been proposed to fill the gap durable nonces currently serve. Anza has put forward something called the Programmatic Signer, while a team called Blueshift has proposed a tool called Vector. As of November 9, 2026, Anza’s replacement was still marked “under construction,” meaning institutions would be migrating to tooling that does not yet exist in its final form.

For regular Solana users who do not hold SOL in an institutional custody setup, SIMD-0723 would likely be invisible in day-to-day use. Standard wallet transactions do not use durable nonces. The change would be felt most by developers, custodians, and protocols that rely on pre-signed admin keys, exactly the category of user the Drift attackers targeted.

The governance decision around SIMD-0723 will determine whether the network accepts the migration cost now in exchange for closing an attack surface that cost the ecosystem a quarter-billion dollars in a single day. The vote is not yet scheduled, and the replacement tooling is not yet ready. What to watch: whether Anza and Firedancer engineers formally approve the proposal, and whether the Programmatic Signer ships in time to give institutions a viable path before any deprecation deadline.

Anyone holding Solana-based assets, using Solana DeFi platforms, or curious about Solana security risks should understand that this proposal, if passed, would represent one of the most significant protocol-level security changes in Solana’s history. It removes a tool that made certain operations more convenient, specifically because that convenience was turned into a weapon.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.