Solv Protocol Loses $2.7M in BRO Vault Exploit as SOLV Token Rallies 3.5%

BRO Vault Exploit: What Happened

On March 5, Solv Protocol — a decentralized BTCFi platform — suffered a targeted exploit that resulted in the theft of approximately $2.7 million. The attack affected fewer than ten users, with total losses amounting to 38.0474 SolvBTC.

«Incident Update: BRO Vault. A limited exploit occurred in one of our BRO vaults, affecting a very small number of users (<10). The impacted amount is 38.0474 SolvBTC. All other vaults and user funds remain secure and unaffected. We're actively investigating with top security…» — Solv Protocol (@SolvProtocol), original post

The Solv team confirmed that only one BRO vault was compromised, while all other vaults and user funds remained secure.

Exploit Mechanics: Double-Minting via ERC-3525

According to analysis by Decurity, the attacker discovered a critical double-minting vulnerability in the BitcoinReserveOffering (BRO) contract. The flaw resided in the mint() function: when a user minted tokens by transferring a full ERC-3525 NFT, the doSafeTransferIn call triggered the onERC721Received callback, which initiated a second minting operation.

«@SolvProtocol has been exploited for $2.7M. The BitcoinReserveOffering (BRO-SOLV-20MAY2026) contract's mint() function has a double-minting flaw. When a user mints by transferring a full ERC-3525 NFT, doSafeTransferIn triggers the onERC721Received callback which mints BRO…» — Defimon Alerts (@DefimonAlerts), original post

The attacker exploited this vulnerability 22 times in succession, inflating 135 BRO into 567 million BRO tokens. These were subsequently swapped for approximately 38 SolvBTC.

Why This Matters

Solv Protocol positions itself as the largest on-chain Bitcoin reserve, holding a total balance of 24,226 BTC. The platform's TVL includes 8,847 BTC valued at $623 million. While the $2.7 million exploit represents less than 0.5% of the protocol's TVL, it raises questions about smart contract audit quality across major BTCFi protocols.

Solv Protocol TVL data. Source: DefiLlama

Double-minting vulnerabilities fall under the category of reentrancy attacks — one of the most well-known exploit vectors in DeFi. The fact that such a flaw passed through auditing raises additional security concerns for the project.

Team Response and Investigation

Solv Protocol developers committed to fully compensating all affected users. The investigation is being conducted jointly with three major security firms: Hypernative Labs, SlowMist, and CertiK. The team has already implemented measures to prevent further exploitation of the same vulnerability.

Additionally, the platform extended a 10% white-hat bounty offer to the attacker — a common DeFi practice where exploiters are incentivized to return 90% of stolen funds in exchange for keeping a portion as a reward. This approach has yielded successful recoveries in several past incidents.

SOLV Token Rallies Despite the Hack

In a counterintuitive market reaction, the exploit news did not tank the platform's native token. SOLV gained 3.5% over the past 24 hours and was trading around $0.004 at the time of reporting.

SOLV/USDT hourly chart on Binance. Source: TradingView

For context, in August 2025, the Solv Protocol team launched BTC+ Vault — a product that enables Bitcoin holders to automatically earn yield on assets deposited in the vault.