Starknet lending protocol Nostra paused its money market on Thursday after a price oracle manipulation enabled one account to borrow roughly $3.5 million against NSTR collateral. All lending, borrowing, withdrawals, and liquidations remain unavailable as the team assesses the damage.
The attacker pledged NSTR tokens and withdrew Ethereum, Starknet tokens, USDC, USDT, Wrapped Bitcoin, and DAI totaling six times the collateral's market value. Security firm PeckShield reported that $1.92 million was bridged to Ethereum, including 234.57 ETH and 1.3 million DAI.
The protocol experienced significant deposit outflows following the exploit. Total value locked in Nostra fell from approximately $4 million on September 16 to roughly $710,632 as of the incident report, according to DefiLlama data.
Second Oracle Failure on Starknet This Month
Nostra's incident follows another oracle issue on Starknet earlier in September. On September 4, an incorrect price from Pragma's publishing pipeline affected multiple Starknet feeds, triggering 47 liquidations across 42 borrower wallets on money market Vesu. Pragma reported 95% asset recovery in a subsequent update.
The two incidents differ in origin. Pragma's failure stemmed from a publishing fault in its pipeline, while Nostra's protocol was subject to deliberate price manipulation.
Recovery Prospects Uncertain
Nostra stated it is reconciling the impact on each asset and tracing the funds. The team noted that final loss figures and potential recoveries remain unknown at this stage.
Nostra also warned users to be vigilant against impersonators, stating it will not send direct messages or request wallet connections during the recovery process.
Broader Sector Losses in September
September has seen significant losses across the cryptocurrency sector. Prior to the Nostra incident, DefiLlama had logged more than $326 million in crypto losses for the month, with the majority stemming from the $320 million Liquid Network incident.
