Nostra's $3.5M oracle borrow is Starknet's second in two weeks

Nostra paused its Starknet money market on Thursday after a manipulated NSTR price oracle let one account borrow about $3.5 million against NSTR collateral. Lending, borrowing, withdrawals and liquidations stay unavailable while the team reconciles each asset. Nostra said it is still tracing the funds, and that the final loss and potential recoveries are not yet known.

The attacker pledged NSTR and drew ETH, STRK, USDC, USDT, WBTC and DAIv1 from the money market. NSTR's entire market value sat at about $546,751, so the haul ran roughly six times the size of the collateral token itself. PeckShield reported the attacker bridged $1.92 million of the proceeds to Ethereum, in 234.57 ETH and 1.3 million DAI.

What's paused, and what isn't public

Lending, borrowing, withdrawals and liquidations on Nostra stay frozen while the team reconciles positions across each asset. Total value locked fell from about $4 million on September 16 to roughly $710,632 at the time of the incident, per DefiLlama. On-chain transaction hashes for the borrow call or the Ethereum bridge have not been published, and the protocol's contract address and the attacker wallet are not yet in the public record.

The $3.5 million borrowed and $1.92 million bridged are the only dollar figures in circulation; no protocol loss number has been published. Nostra has warned users about impersonators, and said it will never send direct messages or ask holders to connect a wallet during recovery.

Starknet's second oracle hit in two weeks

Nostra is the second Starknet protocol hit by an oracle failure this month. On September 4, an incorrect price from oracle provider Pragma's publishing pipeline went out across several Starknet feeds and triggered 47 liquidations across 42 borrower wallets on money market Vesu. Pragma reported 95% asset recovery from that incident in a September 13 update. The two causes differ: Pragma's was a publishing fault, Nostra's was deliberate manipulation of a collateral price.

September's running tally

DefiLlama had logged more than $326 million in crypto losses this month before Nostra, with most of it from a $320 million Liquid Network incident. The Nostra borrow sits inside the 2026 pattern PeckShield has flagged in its August count: 50 hacks, the highest monthly tally of the year, with total losses down 49.5% to $136.3 million. Frequent, smaller thefts are now the typical shape of a crypto month.