Solv Protocol (BRO Vault) hack — March 2026

On 5 March 2026 an attacker drained 38.0474 SolvBTC, about $2.7 million, from a single Bitcoin Reserve Offering (BRO) vault operated by Solv Protocol on Ethereum.

Solv's post-incident review describes the vault as a standalone, one-time, limited-scope and non-public deployment created in connection with the Solv token listing rather than one of its public products, and says it had not been subject to the same level of operational process and security rigour as the established products. Two participants were associated with the vault, and Solv says no other product or public offering was affected.

Independent analyses by DarkNavy, Halborn and Taichi Audit identify the flaw as a double mint reachable through a callback. The BRO wrapper handles ERC-3525 positions; when an entire position was transferred using safeTransferFrom(), the onERC721Received() callback minted BRO while the outer mint() call was still executing, and mint() then minted again for the same deposit on completion. Although mint() itself carried a nonReentrant guard, the callback was unguarded and carried no context flag, so the same value was credited twice. Taichi Audit is explicit that this is not technically a reentrancy exploit but a double-accounting bug, and DarkNavy describes the guard being bypassed through parallel execution rather than direct reentrancy. DarkNavy records that the attacker deployed two contracts and ran 22 burn-and-mint cycles, inflating 135.36 BRO into 567,758,681 BRO, redeeming part of it for 38.047 SolvBTC and realising about 1,211 ETH, while retaining some 402 million illicit BRO.

Reported dates differ by a day. Solv's own review and DarkNavy give 5 March 2026, while Taichi Audit and some news coverage date it 6 March, the day it was widely reported. The loss figure is consistent at roughly $2.7 million across Solv's accounting and the third-party analyses.

Halborn reports that Solv offered the attacker a 10 percent white-hat bounty in exchange for return of the remaining funds; no source confirms the offer was accepted or that any funds were returned. Solv said that as of 9 March 2026 all losses associated with the incident had been fully compensated and affected users made whole, and that future vault deployments would require external audit review.