The ERC-3525 Callback Trap: How Solv Protocol's Double-Mint Bug Turned 135 Tokens Into 567 Million

On March 5, 2026, an attacker turned 135 BRO tokens into 567 million — then drained $2.7 million in SolvBTC from Solv Protocol's BitcoinReserveOffering vault. The weapon: a callback-driven double-mint vulnerability hiding in the intersection of ERC-3...