Nostra Starknet Lending Market Paused After NSTR Oracle Exploit

Nostra’s Starknet lending market was paused after a manipulated NSTR oracle price enabled one account to borrow approximately $3.5 million, according to Nostra and a readable Phemex report. The incident highlights how a single pricing feed can affect collateral checks, borrowing limits and liquidation systems in decentralized finance.

What happened at Nostra

Nostra’s verified account said a manipulated NSTR oracle price allowed one account to borrow roughly $3.5 million. The protocol paused lending, borrowing, withdrawals and liquidations while it investigated the event. Nostra said final losses and recoveries were still being assessed at the time of the announcement.

Incident detail	Reported information
Protocol	Nostra Starknet money market
Attack vector	Manipulated NSTR oracle price
Borrowing enabled	Approximately $3.5 million
Funds bridged to Ethereum	Approximately $1.92 million, according to reporting
Emergency response	Lending, borrowing, withdrawals and liquidations paused
Final recovery status	Still under assessment at the time of the report

Where the funds moved

Phemex reported that approximately $1.92 million was bridged to Ethereum after the borrowing transaction. Bridging can make tracing and recovery more complicated because the assets move between networks, contracts and liquidity venues. The reported amount should be treated as an incident estimate until Nostra publishes a complete accounting.

Oracle manipulation attacks exploit the gap between a token’s displayed price and its actual available market value. If a lending protocol accepts the inflated price as collateral, an attacker may deposit a relatively inexpensive asset, borrow more valuable assets and leave the protocol with undercollateralized debt after the price normalizes.

Pausing liquidations can appear counterintuitive during an exploit, but emergency controls may help preserve evidence and prevent additional state changes while developers inspect positions and pricing data. The correct response depends on the protocol’s governance, contracts and incident procedures.

What the exploit shows

The incident puts oracle design at the center of DeFi risk. A robust system may combine multiple markets, time-weighted prices, liquidity thresholds, circuit breakers and caps on how much a thinly traded asset can support in borrowing. These controls can reduce the impact of a single manipulated price, though they also introduce latency and governance tradeoffs.

Users should avoid assuming that a paused market guarantees funds will be recovered. They should monitor Nostra’s official updates, avoid interacting with unofficial recovery links and treat messages requesting seed phrases or emergency deposits as likely scams. Borrowers and liquidity providers should also review how withdrawals, liquidations and bad debt are handled after a market pause.

Nostra’s response remains an evolving incident rather than a completed loss report. Its final assessment should clarify the oracle failure, affected markets, assets borrowed, recoveries and remediation steps. Until then, the event is a warning that DeFi composability depends not only on smart-contract code but also on the accuracy and resilience of external price data.

Read the readable incident report and Nostra’s official update. Follow more DeFi security coverage at VORTFLUX.