What happened
On September 17, 2026, Starknet money market Nostra Finance suffered an oracle price manipulation exploit resulting in ~$3.53 million in unauthorized borrows across ETH, STRK, USDC, USDT, WBTC, and DAIv1 against inflated NSTR collateral, forcing the protocol to pause all lending, borrowing, and liquidation operations.
The attacker exploited Nostra Finance's collateral valuation oracle for NSTR by manipulating its underlying price pool on Ekubo DEX. The attacker withdrew existing liquidity around NSTR's real market price, seeded a decoy liquidity band at $99 per NSTR, and routed a $14.72 dust swap (190 NSTR) through the gap to artificially inflate the oracle price by 16,645x. Using just 294,177 NSTR collateral, normally worth ~$1,756, the attacker leveraged the inflated valuation to draw $3,531,922.97 in mixed assets across six borrowing legs.
The attacker then bridged ~$1.93 million (234.57 ETH and 1.3M DAI) to Ethereum while leaving ~$1.55 million in assets on Starknet.
Starknet Attacker Contract: 0x06d48ef7…344bc3
Ethereum Destination Address: 0xa059aaab…7f3c37
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
