The Drift Protocol attack was unusual in that it didn't involve a traditional hack, such as a bug in the code or a cracked private key. Instead, the attacker leveraged a legitimate Solana feature known as 'durable nonces' to deceive Drift's security council into pre-approving transactions that would be executed at a later time, in a context that the signers had not intended. This resulted in the loss of at least $270 million in under a minute, but the setup took over a week.
Durable nonces are a Solana feature designed to override the safety mechanism that prevents old transactions from being replayed. They replace the expiring blockhash with a fixed 'nonce' stored in a special on-chain account, making the transaction valid indefinitely until it's submitted. This feature is meant for legitimate uses, such as hardware wallets and institutional custody solutions, which need to prepare and approve transactions without being forced to submit them within a short time frame. However, it creates a problem because once a transaction is signed, it can be executed at any time, and the signer has no way to revoke their approval unless the nonce account is manually advanced.
The attacker exploited this by getting two members of Drift's Security Council to sign transactions that they likely thought were routine. These transactions were then used to bypass the multisig security and drain the funds. The attack highlights the risks associated with social engineering and operational security failures in DeFi protocols, rather than code vulnerabilities.
The use of durable nonces in this attack is particularly concerning because it exploits a feature that is difficult to defend against without fundamentally changing how multisig approvals work on Solana.