Nostra pauses Starknet money market after $3.5M NSTR oracle over-borrow
By 8bitcrypto
September 18, 2026
Nostra Finance paused its Starknet money market after disclosing that a manipulated NSTR oracle price let a single account treat native-token holdings as inflated collateral and borrow roughly $3.5 million in liquid assets on September 17, 2026. In an official statement posted on X at 13:28 UTC, the protocol said the borrowed basket included ETH, STRK, USDC, USDT, WBTC, and DAIv1. Lending, borrowing, withdrawals, and liquidations are offline while the team reconciles pools and traces funds. Final loss and any recoveries remain unknown, Nostra said.
The Rug & Recovery Room line is an oracle-to-collateral mismatch, not a claimed bug in Nostra’s core money-market code. When a lending market’s price feed prints above true market value, the same token balance counts as larger collateral and unlocks more borrow capacity than the collateral is worth. Independent recaps of Nostra’s statement, including TechFlow, said deposits, borrows, withdrawals, and liquidations were suspended pending pool-by-pool checks. Nostra also warned users it will never send direct messages or ask anyone to connect a wallet for “recovery”—a standard phishing warning after DeFi freezes.
Security desks moved overnight. PeckShield alerted at 00:41 UTC on September 18, confirming the about $3.5 million figure and reporting that roughly $1.92 million had already bridged to Ethereum mainnet as 234.57 ETH and about 1.3 million DAI. CertiK flagged the incident at 02:30 UTC and followed at 02:48 UTC with explorer links, estimating about $1.55 million still on a Starknet contract via Voyager and about $1.93 million bridged to an Ethereum address on Etherscan. Those monitored splits reconcile within rounding to Nostra’s disclosed total. Nostra itself has not confirmed the Ethereum receiving address or the exact ETH and DAI amounts PeckShield published.
DefiLlama logged a September 17 incident against Nostra Money Market for $3.5 million, classified as oracle manipulation via spot-price manipulation on Starknet. Around the time of reporting, DefiLlama showed NSTR near $0.0055 with a circulating market capitalization near $549,675. The borrowed notional therefore sat more than five times above the collateral token’s entire circulating market cap—the arithmetic that makes thin-token oracles dangerous when they back liquid borrow markets. PeckShield and CertiK have not yet published a full transaction graph, the exact oracle contract, pre- and post-attack NSTR prints, or confirmation that a thin DEX pool moved the feed. Those details wait on Nostra’s promised post-mortem.
This is Nostra’s second publicly disclosed Starknet price-feed failure. On March 24, 2025, the protocol said oracle feeds for xSTRK and sSTRK had inflated by about three times between Starknet blocks 1256310 and 1256360, with one cited example moving xSTRK from $0.1793 to $0.5897. Then, Nostra cut collateral caps to zero, paused new borrows against those assets, and told users to withdraw. That episode was framed as a feed error that risked wrongful liquidations. September 2026 is framed as alleged manipulation that enabled over-borrowing. The shared risk factor is Starknet ecosystem token prices used as lending collateral.
Oracle sourcing remains an open question for the desk. In May 2026, Nostra announced Chainlink Price Feeds on Starknet for BTC, DAI, ETH, LINK, STRK, USDC, USDT, and wstETH. NSTR was not on that initial list. Whether the NSTR feed later ran through Chainlink, Starknet-native Pragma, or another provider was not clarified in the September 17 statement. Until Nostra names the feed and the print history, desks should treat “which oracle failed” as unverified.
Nostra’s product suite on Starknet includes Money Market, Pools, Money Market Alpha, and nstSTRK, its STRK liquid-staking derivative, with disclosed plans to build on Monad. Official communications say the current incident is confined to the Starknet money market and does not affect those other products—attribute that scope claim to the team until independent forensics say otherwise. Former chief executive David Garai stepped down after the NSTR airdrop in June 2024; that leadership change is background, not a causal claim for this exploit.
For NFT and crypto readers, the lesson tracks the same collateral math that hits GameFi and collectible-lending desks when thin floor tokens or governance tokens back liquid borrows: if the oracle can be moved faster than liquidators and risk engines, depositors eat the gap. Earlier this week Blockaid flagged a separate Flamincome VaultYUSDT share-price exploit netting about $345.9K, and Ostium Labs remains in a New York federal court dispute tied to a July oracle-linked loss—industry context only, not linked incidents. Attribute Nostra’s $3.5 million borrow figure to the protocol’s own disclosure and the PeckShield/CertiK bridge splits to those firms.
Still unverified at press time: the exact start and end blocks of the manipulated NSTR print, the oracle provider for NSTR at the moment of attack, a full per-asset borrow ledger, whether $3.5 million is realized bad debt or gross borrowed notional, any freeze or return on the Ethereum receiving address, and any depositor haircut. Treat those as open until Nostra or its security partners publish confirmed figures. Updates are being routed through Nostra’s Discord, per secondary reporting of the team’s recovery channel.
On September 18, the Rug Room file is Nostra freezing its Starknet money market after a manipulated NSTR oracle enabled about $3.5 million in over-borrowing—security firms already tracking roughly half the take bridged to Ethereum while pools stay dark.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
