Nostra Halts Its Starknet Money Market After a $3.5M Oracle Exploit

Nostra paused its money market on Starknet after one account borrowed about $3.5 million against its own holdings of NSTR, the protocol's token, at a price that had been manipulated. Supply, borrow and liquidation are all disabled. The borrowed basket held ETH, STRK, USDC, USDT, WBTC and DAIv1, and it is worth several times everything NSTR is worth in circulation. Roughly $1.92 million of it has since moved to Ethereum. No funds had been recovered by Friday.

The loan is bigger than the token

Two readings of NSTR's size are in circulation. BeInCrypto puts the token's market value at $546,751 on DefiLlama data and the borrowing at about six times it. The Crypto Times and CryptoDaily use the same source and give a range, $550,000 to $590,000, with NSTR trading between $0.0055 and $0.0059, and both call the loan more than five times the cap. They do not reconcile, on the cap or on the multiple. All three describe the same shape: a lending market accepted more collateral value from one token than that token has ever been worth in total.

Two dates for one attack

The accounts split on when it happened. Cryptonomist, The Crypto Times, CryptoDaily and StablecoinInsider all put the exploit on 17 September, and Cryptonomist is the only one of them carrying clock times. BeInCrypto dates the incident to 18 September and describes the pause as falling on a Thursday. 17 September was the Thursday. Neither account corrects the other. Nostra's own statement went out at 13:28 UTC on 17 September, the earliest fixed point any of the six accounts read for this piece supplies.

How the price was moved, on one firm's account

Only one description of the mechanism exists. GoPlus Security, as carried by Cryptonomist, says the attacker opened a fake NSTR/SolvBTC pool with 1.5 SolvBTC at 05:23 UTC, wash traded it for twenty minutes, then pushed NSTR to $49.5 from about $0.006 in the minute before the borrowing began. The lever it names is GeckoTerminal's pool-selection algorithm, the logic that decides which trading pool a quoted price is taken from. A thin fake pool that wins that selection can set the price without much capital behind it. Six borrows followed between 05:48 and 05:50, and the proceeds were sold across AVNU, Ekubo and JediSwap over the next hour and a quarter. That account stands unverified by the other five outlets. PeckShield published the first breakdown at 00:41 UTC on Friday and named oracle manipulation as the cause without detailing any pool, CertiK flagged the incident at 02:30 and added explorer links eighteen minutes later, and SlowMist classified it the same way. Price feeds have cost lenders more than this on their own. Bonzo Lend lost $9.05 million to a flaw in a price oracle, and Ostium lost $23.75 million after its price feed key was compromised.

Tracing, and the numbers that move while it runs

Nostra's statement is short on conclusions.

"We are reconciling the impact on each asset and tracing the funds. The final loss and potential recoveries are not yet known," the team said.

CertiK's tracking puts $1.92 million on Ethereum as 234.57 ETH and 1.3 million DAI. Phemex reports the same ETH figure with 1 million DAI. The residue left on Starknet is about $1.55 million on one count and about $1.5 million on another, and we could not establish which tally supersedes which. The Ethereum address receiving the funds is unconfirmed by Nostra. Users have been told the team will never send direct messages or ask anyone to connect a wallet during recovery, a line worth repeating because impersonators follow these incidents. BeInCrypto alone puts the protocol's total value locked near $4 million on 16 September against roughly $710,632 later in the week, and reads September's sector losses as above $326 million on DefiLlama data before this incident landed. Neither figure is corroborated elsewhere. What nobody has published is a reopening date for the money market, or the change to the NSTR feed that would have to come first.