Solana-based Drift Protocol Blames $270 Million Hack on ‘Durable Nonce’

Drift Protocol has attributed the recent $280 million exploit to an attack involving durable nonces. In a post confirming the incident, the Solana-based DeFi platform described the attack as a ‘novel’ approach that enabled the hacker to assume control of Drift Security Council administrative power.

At the time of the incident, which happened on April 1,  the decentralized exchange paused deposits and withdrawals. It was later described as a complex and sophisticated attack. Criticisms have followed the incident, which is the biggest crypto hack in 2026.

Attacker Exploited Durable Nonce to Presign Approvals

Signs of the hack were first detected early on April 1 when funds were moved from the DEX wallet vault to a Solana address. This started with 41 million JLP tokens, followed by other tokens.

The incident sparked speculation about how the attacker gained access to Drift Protocol vaults, with many suggesting it could be a private key compromise. The DeFi platform has now clarified, stating that it involved durable nonces.

It said:

“This was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution, including the use of durable nonce accounts to pre-sign transactions that delayed execution.”

Durable nonces are a Solana feature that allows transactions to persist without expiring. This allows users to create delayed transactions, perform offline signing, and submit presigned transactions later.

According to the protocol’s preliminary report, the attack was not due to any bug in its smart contract or compromise of seed phrases. Instead, the attacker obtained unauthorized or misrepresented transaction approvals by using durable nonces and social engineering.

These approvals were later used to execute the exploit that impacted several protocols within the Solana ecosystem. Piggybank_fi, Ranger Finance, TradeNeutral, Elemental DeFi, Reflect Money, and others either confirmed minimal exposure or paused deposits.

Meanwhile, the incident has led to a 5% drop in Solana value, with the token falling as low as $78 earlier today. The decline meant further pressure for SOL, which has already fallen 37% this year, while the DRIFT token also declined 25%.

Attack Planned Since March

Interestingly, the attack appears to be well planned. The hacker gained access to the Drift multisig as early as March 23, when the initial nonce was set. The report noted that the attacker controlled two of the four nonce accounts created at the time, while Drift Security Council members controlled the other two.

This effectively gave the threat actor control of 2/5 of the multisig signers, which they used to sign transactions tied to durable nonce accounts, enabling delayed execution. They continued to maintain this multisig even when another multisig migration happened on March 27 due to a change in council membership.

Before the exploit, the attacker executed a test withdrawal from the insurance fund. They later completed an Admin Takeover, during which they executed pre-signed durable nonce transactions.

The protocol said:

“This attack was enabled by a combination of Pre-signed durable nonce transactions, allowing delayed execution (and) Compromise of multiple multisig signers’ approvals, likely through targeted social engineering or transaction misrepresentation.”

While it stated that it is coordinating with security firms, law enforcements and other stakeholders to trace and freeze stolen assets, it is attracting criticisms. Many users noted that the 2/5 required to approve a transaction is very reckless and enabled the attack.