Nostra, a prominent lending protocol on Starknet, paused its money market operations following a sophisticated oracle manipulation attack that resulted in a $3.5 million loss. The exploit involved an attacker manipulating the price feed of the NSTR token, which allowed them to borrow significant assets against artificially inflated collateral values. As of late September 2026, all core functions including withdrawals and liquidations remain unavailable to users while the development team conducts a full audit and asset reconciliation.
This incident is not an isolated event but rather the latest in a series of high-profile DeFi breaches that have plagued the industry throughout the month. In September 2026 alone, crypto exploits have accounted for over $326 million in lost funds, signaling a resurgence in smart contract and oracle-based vulnerabilities. The Nostra team has stated that they are investigating the specific mechanics of the oracle failure, though recovery prospects for affected users remain uncertain at this time.
From a regulatory perspective, this breach is likely to intensify the US Securities and Exchange Commission (SEC) and CFTC's scrutiny of decentralized price feeds and the 'decentralized' nature of protocol administrative controls. US-based DeFi participants should expect increased pressure for protocols to implement more robust circuit breakers and verified oracle redundancies to prevent such cascading failures. The incident also highlights the risks inherent in using relatively illiquid native tokens as primary collateral in lending markets.
Market observers should watch for the official post-mortem report from Nostra and any potential hardware or software patches deployed to the Starknet network. The immediate impact has seen a sharp decline in NSTR liquidity and a cooling of sentiment across the Starknet ecosystem. Investors are advised to monitor the protocol's social channels for updates on the restoration of withdrawal services, which is currently the highest priority for the community.