On September 17, 2026, Nostra Finance paused its Starknet money market after an oracle price manipulation exploit allowed an attacker to borrow approximately $3.5 million against inflated NSTR token collateral. The borrowed amount exceeded NSTR's entire market capitalization of under $600,000 by over five times. While security firms PeckShield and CertiK tracked the bridging of nearly $1.9 million to Ethereum, Nostra suspended all operations to reconcile pools and investigate the incident.
NSTR oracle manipulation exploit
- ▪An attacker used the manipulated, overvalued NSTR price as collateral to borrow assets worth approximately $3.5 million from Nostra Finance on September 17, 2026.
- ▪At the time of the exploit on September 17, 2026, the NSTR token was trading between $0.0055 and $0.0059, with a circulating market capitalization under $600,000.
- ▪On September 17, 2026, Nostra Finance's lending market on Starknet was exploited for approximately $3.5 million through the manipulation of the price feed for its native NSTR token.
Stolen fund bridging activity
- ▪CertiK reported that approximately $1.55 million of the funds stolen in the September 17, 2026 oracle price manipulation exploit on Nostra Finance's Starknet money market remained in a Starknet contract, while approximately $1.93 million was bridged to Ethereum
- ▪PeckShield reported that the attacker who exploited Nostra Finance on September 17, 2026 bridged approximately $1.92 million of the funds stolen in that exploit to the Ethereum mainnet
Nostra protocol emergency pause
- ▪Following the $3.5 million NSTR oracle price manipulation exploit on September 17, 2026, Nostra Finance paused lending, borrowing, withdrawals, and liquidations on its Starknet money market to investigate the manipulation of its NSTR oracle price feed
- ▪Nostra Finance stated that the final loss and potential recoveries from the September 17, 2026 oracle price manipulation exploit on its Starknet money market are not yet known while pool balances are being reconciled
Oracle collateral valuation mechanics
- ▪The $3.5 million borrowed during the September 17, 2026 oracle price manipulation exploit on Nostra Finance's Starknet money market exceeded the entire circulating market capitalization of the NSTR collateral token by over five times
- ▪Decentralized finance lending markets use oracle price feeds to value collateral, which can allow exploits if an oracle reports an inaccurate, inflated asset price.
March 2025 oracle incident
- ▪During the March 24, 2025 incident in which Nostra Finance reported that oracle feeds for xSTRK and sSTRK had inflated by approximately three times, Nostra Finance reduced collateral caps for xSTRK and sSTRK to zero and paused new borrowing against those assets
- ▪On March 24, 2025, Nostra Finance experienced a price feed error where oracle feeds for xSTRK and sSTRK inflated by approximately three times, risking wrongful liquidations.
2026 DeFi security losses
- ▪During the first half of 2026, Ethereum recorded the highest cryptocurrency security losses at $332 million, followed closely by Solana at $326 million.
- ▪According to DeFiLlama data, cryptocurrency security losses in the first half of 2026 reached $1.1 billion across more than 212 on-chain incidents.
Story comments
Loading comments…