The Drift Protocol attack didn't involve discovering a bug or cracking a private key, nor was it a flash loan exploit or an oracle manipulation. Instead, the attacker leveraged 'durable nonces,' a Solana feature designed for convenience, to pre-sign administrative transfers weeks before they were executed, thereby bypassing the protocol's multisig security in a matter of minutes. The result was the loss of at least $270 million.
Durable nonces are a feature that replaces the expiring blockhash with a fixed 'nonce,' keeping a transaction valid indefinitely until it's submitted. This feature is meant for legitimate uses such as hardware wallets and institutional custody solutions but creates a problem as indefinitely valid transactions can be executed at any time after approval, with the signer having no way to revoke their approval unless the nonce account is manually advanced.
In the case of Drift, the attacker obtained signatures from two Security Council members for transactions that would not expire, eventually using these to execute a malicious admin transfer and drain the vaults. The attack resulted in the theft of roughly $270 million across dozens of tokens, with the largest portion being $155.6 million in JPL tokens. The stolen funds were transferred through various means, including a decentralized crypto exchange and a cross-chain bridge, and were eventually moved to Ethereum addresses via Wormhole. The primary concern here is not a code vulnerability but rather a human layer failure around the multisig, with durable nonces allowing the separation of approval and execution by more than a week, creating a context gap.
This exploit highlights the increasing trend of social engineering and operational security failures in DeFi protocols, with the durable nonce vector being particularly dangerous as it exploits a feature that is difficult to defend against without changing how multisig approvals work on Solana.