Starknet lending protocol Nostra has suspended activity in its money market after a manipulated price oracle let a single account borrow about $3.5 million against NSTR collateral. Lending, borrowing, withdrawals, and liquidations were all halted as the team began reviewing the effect on each asset and tracing the funds.

Nostra said the final loss is not yet known, and any potential recovery remains uncertain. The incident adds to a difficult month for crypto security, and it is the second notable disruption tied to Starknet markets in September.

Borrowing exceeded the token’s market value

According to the protocol’s account, the attacker used NSTR as collateral and borrowed ETH, STRK, USDC, USDT, WBTC, and DAIv1. The amount taken was roughly six times larger than the entire market value of NSTR, which was listed at $546,751.

That imbalance helps explain why the exploit was possible with relatively limited capital. Because the collateral token was small, moving its price required less money than would be needed for a larger asset.

Funds moved out as deposits fell sharply

Blockchain security firm PeckShield reported that $1.92 million from the borrowed funds was bridged to Ethereum. The transfer included 234.57 ETH and 1.3 million DAI, according to the firm’s breakdown.

The protocol’s locked value dropped steeply after the incident. Total value locked fell from about $4 million on September 16 to around $710,632 by press time, showing how quickly user deposits retreated after the market was paused.

Nostra still assessing the damage

Nostra said core market functions will remain unavailable while it reconciles each affected asset. The team has not published a final loss figure and said possible recoveries cannot yet be confirmed.

The protocol also warned users about impersonation attempts during the response process. It said it will not send direct messages or ask holders to connect a wallet as part of any recovery effort.

Another Starknet disruption in a costly month

The incident follows a separate September problem on Starknet. On September 4, an incorrect price produced by Pragma’s publishing pipeline was distributed across several Starknet feeds, leading to 47 liquidations affecting 42 borrower wallets on Vesu.

Pragma said in a September 13 update that 95% of assets had been recovered. The two cases are not the same, however: the Vesu event was tied to a publishing fault, while Nostra said it was dealing with deliberate manipulation of a collateral price.

More broadly, DefiLlama had already logged more than $326 million in crypto losses this month before the Nostra incident, most of it linked to the $320 million Liquid Network event. PeckShield also said August recorded 50 hacks, the highest monthly count of 2026, even though total losses for that month fell 49.5% to $136.3 million. For Nostra, the next confirmed step is the ongoing reconciliation of assets and tracing of funds before any final damage estimate is available.

Source: beincrypto.com