{
  "id": 8439639,
  "title": "Nostra Finance $3.5M Exploit: How an 8,000x Oracle Pump Drained a Starknet Money Market",
  "url": "https://urgent.news/2026/09/19/nostra-finance-3-5m-exploit-how-an-8-000x-oracle-pump-drained-a",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-09-19T10:26:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/qanzhi111/nostra-finance-35m-exploit-how-an-8000x-oracle-pump-drained-a-starknet-money-market-2h2l"
  },
  "original_language": "en",
  "account": "On September 17, 2026, the Starknet lending market Nostra Finance paused operations after an account borrowed approximately $3.5 million in NSTR tokens. Security firms GoPlus Security, PeckShield, CertiK, and SlowMist determined that the incident was caused by oracle price manipulation, not a smart contract flaw or unauthorized mint. Nostra Finance did not need to ship a faulty borrow() function for this exploit. The attacker manipulated the NSTR oracle price from around $0.006 to $49.5 in just 27 minutes, making it 8,000x higher than its actual market value of $546,751. The borrowed basket was about six times the collateral token's entire market cap, a clear case of oracle price manipulation rather than a smart contract bug.",
  "summary": "The Protocol Did Not Need a Broken Function On September 17, 2026 , Starknet lending market Nostra Finance paused supply, borrow, withdrawal, and liquidation after one account borrowed roughly $3.5 million against NSTR collateral. Security coverage from GoPlus Security , PeckShield , CertiK , and SlowMist classified the event as oracle price manipulation , not a core-contract reentrancy or an…",
  "key_points": [
    "Nostra Finance paused operations on September 17, 2026, after $3.5M borrowed in NSTR tokens.",
    "Oracle price manipulated 8,000x, from $0.006 to $49.5 in 27 minutes.",
    "Attackers exploited oracle price, not smart contract bug or faulty borrow() function."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}