The Drift Exploit: Durable Nonces and a 2-of-5 Council

By the Guardian team Updated November 2026 6 min read

Quick answer. Attackers spent months cultivating Drift contributors and got two of five council signers to pre-sign Solana durable nonce transactions. With no timelock, they took admin control on April 1, 2026, and drained about $285 million using fake collateral.

Watch: The Drift Exploit: Durable Nonces and a 2-of-5 Council 1:36

Video transcript

Drift says no smart contract bug caused its April 2026 exploit. The attacker went through the people who approve admin changes.

Chainalysis, BlockSec and the FCA put the loss at about 285 million dollars.

Posing as a trading firm for about six months, attackers got two of five signers to pre-sign transactions. On April 1, those approvals landed one second apart and handed over admin control. Real assets were then withdrawn against fake collateral.

A normal Solana transaction expires in about a minute. A durable nonce keeps it valid until the nonce is advanced, so whoever holds it picks when it lands.

Drift's council had zero timelock, so the final approval and execution ran in one transaction. BlockSec says a timelock would have created a window to detect and block it.

In Guardian's timing of 30 exploits, the first public alert about Drift came 73 minutes after the first exploit transaction.

Solana councils can set a nonzero time lock, raise the threshold, refuse transactions that begin with an advance nonce instruction, and alert on signer nonce accounts and admin changes.

Guardian's Managed Security maps every path to a protocol's funds and reviews every multisig transaction before it is signed. On Solana, Guardian has run nine engagements for Jupiter since November 2025.

Read the full article for every control, or talk to Guardian at guardian.security.

On April 1, 2026, Drift Protocol on Solana lost about $285 million.

Drift said the incident "was not caused by a bug in Drift's programs or smart contracts". The attacker went through the people who approve admin changes.

That makes Drift a case study in signer risk, not code risk. Here is how it worked, and what Solana councils can change.

What Happened on April 1

Drift's admin powers sat with a Security Council: a Squads multisig that needed 2 of its 5 signers, per BlockSec and QuillAudits.

At 16:05:18 UTC, per Chainalysis and QuillAudits, a pre-signed transaction proposed moving admin control to the attacker and cast the first approval. One second later, a second one approved and executed it.

With admin control, the attacker:

Listed CarbonVote Token (CVT), a token it created in March, as collateral.
Priced CVT with an oracle it controlled.
Removed withdrawal limits and loosened risk settings.
Deposited 500 million CVT and withdrew real assets against it.

Sources time the drain differently:

BlockSec: 31 withdrawals over about 12 minutes.
Chainalysis: the largest in the first few minutes, the last confirmed at 18:31 UTC.
Rekt: 128 seconds, citing a proof of concept on GitHub. Our time-to-detection data quotes this figure.

JLP made up $159.3 million of the loss and USDC $71.4 million, according to Chainalysis.

Chainalysis, BlockSec and the FCA put the total at about $285 million. Drift's own table of stolen assets comes to $295.7 million.

The FCA and Chainalysis say the funds were converted to USDC, bridged to Ethereum and swapped for ETH. Chainalysis adds that at least 20 protocols reported disruptions, pauses or losses.

How Durable Nonces Let Signatures Wait

A normal Solana transaction carries a recent blockhash and expires 150 blocks later, within about a minute.

A durable nonce removes that expiry. The transaction carries a value stored in a nonce account instead, and its first instruction must be AdvanceNonceAccount.

Until the nonce is advanced, the signed transaction stays valid. The Solana Foundation says teams use this for air-gapped signing and long approval flows.

So signing and execution come apart. Whoever holds the signed transaction picks the moment it lands.

Advancing the nonce voids the pending transaction, and only the nonce authority can do it. BlockSec notes that otherwise a signer cannot revoke the approval.

The setup at Drift

March 23: four nonce accounts appear, two tied to council members and two held by the attacker (BlockSec).
March 27: Drift migrates the council multisig after a change in membership. BlockSec says this voided the earlier signatures.
March 30: a nonce account tied to a new signer appears. Drift says the attacker "had once again obtained effective usable access to 2 of the 5 signers".
April 1: the two pre-signed transactions land, four slots apart.

Drift said the approvals were most likely obtained through "targeted social-engineering attacks or disguised transaction data".

Chainalysis, citing Drift's investigation, describes the approach:

Posing as a quantitative trading firm and meeting contributors at conferences.
Keeping in contact for about six months.
Onboarding a vault on Drift and depositing over $1 million.
Joining strategy discussions to build trust.

The FCA's account matches. The attackers "posed as legitimate investors" and induced council members to pre-sign malicious transactions.

Chainalysis says at least two council members signed transactions they did not fully understand.

Drift says forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group. Nexus Mutual reports that Drift's April 5 update said the people who met contributors in person were not North Korean nationals.

Why No Timelock Made It Final

A threshold decides who can approve. A timelock decides how long everyone else has to notice.

A Squads v4 multisig sets this in its time_lock field: "How many seconds must pass between transaction voting settlement and execution."

Drift's council had a zero-timelock configuration, according to the FCA and Chainalysis. The FCA says this "enabled the malicious changes to be executed immediately".

The second approval and the execution ran in the same transaction. There was no window to veto, rotate signers or pause.

Reaction time could not make up for it. In Guardian's timing of 30 exploits, the first public alert about Drift came 73 minutes after the first exploit transaction.

BlockSec's conclusion: a timelock would have created a window to detect and block the transfer.

Controls for Solana Councils

Drift's own fixes are a good baseline. Its April 16 update commits to:

Durable nonces disabled for all signers.
Timelocks on all critical admin actions, with real-time alerts.
A dedicated signing device for every multisig signer.
Transaction content verified outside the main signing interface.
Signer identities kept on a need-to-know basis.

Every Solana council can go further.

Configuration

Set a nonzero time lock on any multisig that can transfer admin or upgrade authority.
Make the delay longer than it takes you to reach signers and pause.
Raise the threshold so two people cannot hand over the protocol.
Keep emergency roles narrow: pause only, never admin transfer or market listing.
After a signer change, check every new signer for nonce accounts.

Signing

Refuse council transactions whose first instruction is AdvanceNonceAccount.
Decode and simulate every transaction on a device the signer controls.
Never sign a transaction built or sent by an outside party.

Monitoring

Alert on new nonce accounts tied to signer addresses.
Alert on admin transfers, new collateral, oracle swaps and withdrawal limit changes.
Wire those alerts to a pause that a separate key can trigger.

The Solana Foundation said in October 2026 that durable nonces will be removed, roughly six months after a replacement is ready. No date is set.

Until then, treat them as a signing risk.

How Guardian Reviews Councils

Guardian's Managed Security maps every path to a protocol's funds: the contracts, the roles that can move them, and the keys and multisigs behind each one.

Its security operations team reviews every multisig transaction before it is signed, and every configuration change as it lands.

For onchain teams, multisig management covers the signer set and threshold as people join and leave, signer device hygiene and simulation before approval.

On Solana, Guardian has run nine engagements for Jupiter since November 2025.

If a council is compromised anyway, the next step is the playbook. See our guide to a DeFi incident response plan, and what Web3 MDR is.

Frequently Asked Questions

What is a durable nonce on Solana?

A durable nonce replaces a transaction's recent blockhash with a value stored in a nonce account. The signed transaction then skips the 150-block expiry and can be submitted any time until the nonce is advanced.

Was the Drift exploit a smart contract bug?

No. Drift said the incident was not caused by a bug in its programs or smart contracts. The attacker obtained pre-signed approvals from two of five Security Council signers and then used admin powers as designed.

How much was stolen in the Drift hack?

Chainalysis, BlockSec and the FCA put the loss at about $285 million. Drift's April 16 update lists $295.7 million in stolen assets. JLP and USDC made up most of it, according to Chainalysis.

How can a Solana multisig defend against a durable nonce attack?

Set a nonzero time lock on the multisig and refuse council transactions that begin with AdvanceNonceAccount. Verify every transaction on a dedicated device, and alert on nonce accounts tied to signers and on admin transfers.

Sources

Check what your council would sign

Guardian's security operations team reviews every multisig transaction before it is signed, against a map of every path to your funds.

Talk to Guardian Explore onchain team security