What happened
On September 17, 2026, an attacker inflated the oracle price of Nostra's NSTR token and used it as collateral to borrow about $3.5 million of ETH, STRK, USDC, USDT, WBTC and DAIv1 from the Nostra money market on Starknet. Security firms reported that the price was pushed from about $0.006 to $49.5 (roughly 8,000x) through a thin NSTR/SolvBTC pool, while NSTR's whole market cap was only about $550k. Nostra paused lending, borrowing, withdrawals and liquidations the same day.
PeckShield reported about $1.92 million (234.57 ETH and 1.3 million DAI) bridged to Ethereum; CertiK reported roughly $1.55 million still on Starknet. Nostra said the final loss and any recoveries were not yet known and promised a post-mortem.
How it happened
- The attacker accumulated
NSTRand pre-positioned collateral months earlier (reported as March and August 2026). - On September 17 the attacker created a new NSTR/SolvBTC pool seeded with only about 1.5 SolvBTC of liquidity.
- Roughly 20 minutes of repeated wash swaps through that thin pool printed an NSTR price near $49.5, and GeckoTerminal's pool selection picked up the manipulated pool as the reference price, according to GoPlus and Halborn.
- With
NSTRcollateral valued at the inflated price, one account borrowed about $3.5 million of ETH, STRK, USDC, USDT, WBTC and DAIv1 from Nostra. - Funds were swapped through Starknet DEXs and part was bridged to Ethereum (about $1.92 million per PeckShield) before Nostra paused the market.
Protocol details
Market Context at Time of Hack
Evidence
- report @nostrafinance incident report x.com
- report @coinminutes_en incident report x.com
- report CertiK Alert on Nostra money market price manipulation x.com
- report Nostra (@nostrafinance) incident disclosure on X x.com
- analysis DeFiLlama defillama.com
- analysis Explained: The Nostra Finance Hack (September 2026) halborn.com
- analysis Nostra Finance Exploit Highlights Starknet DeFi Vulnerability en.cryptonomist.ch
- analysis Nostra Halts Its Starknet Money Market After a $3.5M NSTR Oracle Exploit cryptotimes.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
