What happened
On March 5, 2026, a flaw in one Solv Protocol Bitcoin Reserve Offering (BRO) vault let an attacker create unbacked BRO tokens and exchange them for about 38.0474 SolvBTC, valued at roughly $2.7 million at the time. Solv says the one-time, non-public vault was the only affected deployment and that it fully compensated its two affected participants by March 9.
How it happened
- The attacker deposited an ERC-3525 position into the BRO vault's mint path.
- The safe transfer invoked the ERC-721 receiver callback, which minted BRO during the transfer.
- The outer mint flow then minted BRO again for the same operation.
- Halborn reports that repeating the sequence 22 times turned 135 BRO into about 567 million BRO, which was swapped for roughly 38 SolvBTC.
Protocol details
Classification
Other / Protocol Logic / Token & Share Accounting
Protocol Type
Bridge
Implementation language
Solidity
Protocol links
Website
@SolvProtocol
Evidence
- report @SolvProtocol incident report x.com
- report @DefimonAlerts incident report x.com
- analysis DeFiLlama defillama.com
- analysis Post-Incident Review: BRO Vault Incident and Strengthened Security Commitments insights.solv.finance
- analysis The Block: Solv Protocol says exploit drained $2.7 million from Bitcoin yield vault theblock.co
- analysis Explained: The Solv Hack (March 2026) halborn.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
