Skip to content
THREATWIRE

2026-09-17 · record inc_0005 · updated 2026-10-19

Nostra Finance: manipulated NSTR price used as collateral

An attacker made a thin NSTR price look about 8,000 times higher and borrowed about $3.5M against it on Starknet.

Nostra FinancePragmaStarknetComponent: NSTR price feed, lending markets

Event
Official statement
Root cause
Official statement
Loss
Independent analysis

This record is not indexed by search engines: it does not yet have a root cause confirmed from a primary source.

Current status

Recovery ongoing per Pragma; none reported.

Timeline

  1. 2026-09-17Manipulation and borrowing; Pragma publishes an incident update the same day.

Root cause

Per Pragma, the price came from a manipulated on-chain pool and the answer rested on two sources, below the three it recommends.

Basis: official post-mortem · verified by us against that source

Classes: Oracle and spot-price manipulation, Liquidation and collateral logic

Impact: loss and recovery

Borrowing of STRK, USDC, USDT, WBTC and DAI against inflated NSTR collateral.

Reported loss

$3.5M

USD basis: Incident-time estimate (BlockSec, Credora); Nostra said final loss unknown.

Recovered or returned

Unknown

Pragma says the attacker address is frozen and recovery is ongoing; none reported.

Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.

Addresses and transactions

No addresses or transaction hashes have been verified for this record. We do not publish unverified hashes.

Public reproduction file

No public reproduction file is recorded for this incident.

Remediation and defensive indicators

  • Attacker address frozen per Pragma; markets paused per BlockSec. (reported)

Defensive lessons from the class

  • Estimate what it costs to move each price and compare it with what that price controls.
  • Require a minimum number of genuinely independent sources and reject answers below it.
  • Limit exposure to thin collateral.
  • Add circuit breakers on abnormal moves.

Sources

  • Official post-mortem

    Pragma: Nostra NSTR incident update

    Published 2026-09-17 · retrieved 2026-10-19

  • Independent analysis

    BlockSec: Multicall router and Nostra exploits

    retrieved 2026-10-19

  • Independent analysis

    Credora: Risk in DeFi, September post-mortem

    retrieved 2026-10-19

  • Independent analysis

    Halborn: The Nostra Finance hack explained

    retrieved 2026-10-19

  • Independent analysis

    PublicAML: Nostra hack

    retrieved 2026-10-19

Similar incidents

Read the full written analysis

Method, uncertainty and corrections

Still unknown

  • Final loss
  • Which source carried the fake price
  • Who covers depositors

Where sources disagree

  • Which source moved: Pragma does not say; Halborn and GoPlus name GeckoTerminal.
  • Size of the move: about 8,000x versus about 8,300x.

Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.

No corrections recorded since publication.