preferred on
Points of Focus
- One account borrowed about $3.5 million against manipulated NSTR collateral on Nostra.
- The affected oracle response used two price sources, below Pragma’s recommended minimum of three.
- About $1.92 million was bridged to Ethereum as recovery efforts continued.
Nostra paused its Starknet money market after a manipulated NSTR oracle price allowed one account to borrow about $3.5 million in Ether (ETH), Starknet (STRK), USDC (USDC), Tether’s USDt (USDT), Wrapped BTC (WBTC), and DAIv1 against inflated collateral.
The borrowed amount was 5.8 times NSTR’s $600,684 market capitalization on Sept. 17, while Nostra said final losses and potential recoveries were still being determined.
NSTR oracle response used only two price sources
Oracle provider Pragma said the incident involved manipulation of an illiquid NSTR market, with a distorted onchain pool price entering the oracle response. Its reconstruction found no decimals or median-calculation error.
The affected response included only two contributing price sources. Pragma’s integration guidance recommends at least three, and the company said enforcing that minimum would have rejected the manipulated response.
Pragma had already classified NSTR as a high-risk feed because of limited liquidity and source coverage. The company said it previously raised those risks with Nostra. Gate.io had also been removed as a pricing source at Nostra’s request over illiquidity and manipulation concerns.
$3.5-million borrow was 5.8 times NSTR’s market cap
For scale, CoinGecko recorded NSTR’s market capitalization at $600,684 on Sept. 17, with just $59.98 in trading volume. The account borrowed about $3.5 million across six assets.
Market capitalization doesn’t measure executable liquidity, but the gap shows how much larger the borrowed assets were than NSTR’s circulating value. Pragma made a related point, saying an oracle price doesn’t establish that meaningful amounts of collateral can be sold at that price.
Nostra paused lending, borrowing, withdrawals, and liquidations after the incident while reconciling its pools and tracing the funds.
On September 17, a manipulated NSTR oracle price enabled one account to borrow approximately $3.5 million worth of ETH, STRK, USDC, USDT, WBTC and DAIv1 against NSTR collateral in the Nostra money market on Starknet.
The Nostra money market is paused: lending, borrowing,…
— Nostra (@nostrafinance) September 17, 2026
Attacker bridges $1.92 million to Ethereum
Security analysts at CertiK reported that about $1.92 million had been bridged to Ethereum, including 234.57 ETH and 1.3 million Dai (DAI).
DefiLlama classifies the Sept. 17 Nostra incident as oracle manipulation using spot-price manipulation. Pragma said the attacker’s address had been frozen and that it was working on asset recovery.
Pragma’s latest incident report, dated Sept. 17, lists the recovery as ongoing.
Share
Most read articles
