Nostra Oracle Exploit: $3.5M Borrowed After NSTR Price Manipulation
Nostra Oracle Attack: $3.5M Borrowed From Starknet Money Market
DeFi protocol Nostra disclosed on September 17 that a manipulated NSTR oracle price allowed a single account to borrow roughly $3.5 million in assets against NSTR collateral, prompting an immediate pause of its Starknet money market.
At a Glance
-
Incident date: September 17, 2026
-
Cause: Manipulated NSTR oracle price
-
Amount borrowed: ~$3.5 million (ETH, STRK, USDC, USDT, WBTC, DAIv1)
-
Status: Nostra money market paused; investigation ongoing
Nostra Oracle Exploit: What Happened on September 17?
The protocol reported that its NSTR oracle price feed was manipulated on September 17, 2026. The distortion allowed one account to post NSTR as collateral and borrow approximately $3.5 million worth of other assets from Nostra's money market on Starknet. The protocol confirmed the incident directly, describing it as an oracle-price manipulation event rather than a smart contract exploit in the traditional sense.
Source: Nostra Finance
How the NSTR Oracle Manipulation Enabled the $3.5M Borrow
In a lending protocol, an oracle network feeds real-time asset prices into the system so it can calculate how much a user can borrow against their collateral. When that price feed reflects an inflated value, borrowing limits tied to the affected token become distorted too.
According to official crypto update, the manipulated NSTR price effectively inflated the value of the attacker's collateral, letting them draw out far more in borrowed assets than the token's real market value would normally allow. It has not detailed the exact manipulation method, and specifics should be treated as unconfirmed until the team's formal investigation concludes.
Which Crypto Assets Were Borrowed in the Nostra Exploit?
The borrowed funds spanned six different assets, all drawn against the same collateral position:
| Asset | Role in Incident | Approx. Value/Status |
| ETH | Borrowed using NSTR | Part of ~$3.5M total |
| STRK | Borrows | Part of ~$3.5M total |
| USDC | Borrow | Part of ~$3.5M total |
| USDT | Borrowing | Part of ~$3.5M total |
| WBTC | Borrows | Part of ~$3.5M total |
| DAIv1 | Borrowing | Part of ~$3.5M total |
It has not published an individual dollar breakdown per asset, so no per-token figures should be assumed until a verified accounting is released.
Source: Wu Blockchain
Nostra Money Market Paused: What Functions Are Currently Unavailable?
As an immediate containment step, the protocol paused its Starknet money market entirely. Lending, borrowing, withdrawals, and liquidations are all currently unavailable to users.
The pause gives the team room to assess the scope of the incident, trace the borrowed funds, and prevent further exposure while the situation is under review.
Nostra Investigates Losses and Tracks the Borrowed Funds
It has stated that the final loss figure and the amount that may ultimately be recovered are both still undetermined. The team is reconciling the impact asset by asset and actively tracing where the borrowed funds have moved. It is also said it is coordinating with relevant parties to pursue recovery options, though no timeline for resolution has been given yet.
Nostra Exploit Timeline: From Oracle Manipulation to Protocol Pause
September 17, 2026
→ The NSTR oracle price was manipulated.
→ One account borrowed roughly $3.5 million across multiple assets using NSTR as collateral.
→ It paused its money market functions.
→ The team began assessing affected assets and tracing the funds.
September 18, 2026
→ It continued its investigation and fund-tracing work.
→ Final losses and potential recoveries remained undetermined.
→ The protocol said verified updates, including a detailed post-mortem, would follow.
Nostra Warns Users About Impersonation Scams
It has explicitly warned that it will never DM users or ask them to connect a wallet as part of any recovery process. Users are urged not to share personal information or connect wallets to anyone claiming to assist with fund recovery on Nostra's behalf. The protocol said all legitimate updates will be posted through its official Discord and other verified channels only.
What the Nostra Oracle Exploit Means for Users and the Protocol
At this stage, the confirmed facts are limited: an oracle manipulation occurred, roughly $3.5 million was borrowed against NSTR collateral, and the money market is paused while Nostra investigates.
What remains unresolved includes the final loss total, how much may be recoverable, and the precise mechanism behind the price manipulation. Users are advised to rely on Nostra's official channels rather than community speculation, particularly given the elevated risk of impersonation scams following incidents like this. It has committed to releasing a detailed post-mortem once its review is complete, and the money market will remain paused in the interim.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are volatile and carry risk; details of this incident may change as Nostra's investigation progresses. Readers should verify updates through Nostra's official channels before taking any action.
