Starknet Lending Protocol Nostra Halts Operations After Oracle Manipulation

Starknet‑based lending platform Nostra (NSTR) suspended its entire money market on Thursday following a price‑oracle manipulation that let one user borrow roughly $3.5 million worth of assets against NSTR collateral.

Incident Overview

The compromised oracle enabled the attacker to pledge NSTR and draw multiple assets, including Ethereum (ETH), Starknet (STRK), USDC, USDT, Wrapped Bitcoin (WBTC) and DAIv1. The total value of the borrowed assets exceeded the market cap of NSTR by about six times.

Immediate Impact

• All lending, borrowing, withdrawals and liquidations have been disabled.
• Total value locked in Nostra fell from roughly $4 million on September 16 to about $710,632 at the time of reporting.
• Security firm PeckShield traced a $1.92 million bridge to Ethereum, consisting of 234.57 ETH and 1.3 million DAI.

Recovery Efforts

Nostra’s team is reconciling each affected asset and tracing the funds. The final loss amount and any potential recoveries have not been disclosed. The protocol warned users against impersonators, stating it will never request direct messages or wallet connections for recovery purposes.

Context Within Starknet

This is the second major oracle‑related incident on Starknet in September. On September 4, Pragma’s publishing pipeline error caused incorrect prices across several feeds, triggering 47 liquidations on the Vesu money market. Pragma later reported a 95 % asset recovery rate.

Broader DeFi Landscape

DefiLlama recorded over $326 million in crypto losses for September, largely driven by the $320 million Liquid Network breach. The month follows a trend of frequent, smaller‑scale thefts, with PeckShield noting 50 hacks in August—the highest monthly count of 2026—despite a 49.5 % drop in total loss value.