Nostra halts market after $3.5M oracle exploit

Nostra, a lending protocol on Starknet, halted its money market after a manipulated price oracle allowed a single account to borrow roughly $3.5 million using NSTR tokens as collateral. Lending, borrowing, withdrawals and liquidations remain suspended while the protocol reconciles assets and traces fund movements.

The borrower pledged NSTR and withdrew Ethereum, Starknet’s native token STRK, USDC, USDT, Wrapped Bitcoin and DAIv1. Security firm PeckShield reported the exploiter bridged about $1.92 million to Ethereum, including 234.57 ETH and 1.3 million DAI.

Market data showed NSTR’s market value at about $546,751, a small float that can be moved with limited capital. On-chain metrics indicated total value locked in Nostra fell from about $4 million on Sept. 16 to roughly $710,632 at press time.

On Sept. 4, incorrect prices from a Pragma publishing pipeline were distributed across several Starknet feeds, triggering 47 liquidations on the Vesu money market. Pragma later reported recovering about 95% of affected assets. The Pragma incident resulted from a publishing error; the Nostra loss followed deliberate manipulation of a collateral price.

Nostra wrote in an update: “We are reconciling the impact on each asset and tracing the funds. The final loss and potential recoveries are not yet known.” The update also warned users about impersonators and stated the protocol will not send direct messages or ask holders to connect a wallet during recovery.

Before the Nostra exploit, trackers had logged more than $326 million in crypto losses for September, most of that tied to a separate $320 million exploit. Nostra’s team continues to trace funds and assess recoverability while market functions remain suspended.