Nostra Starknet Oracle Manipulation — $3.5M Borrowed, Market Still Frozen

On September 17, 2026, between 05:23 and 07:08 UTC, an attacker manipulated a fake NSTR/SolvBTC liquidity pool to inflate collateral values on Nostra, a Starknet lending protocol, borrowing approximately $3.5M in ETH, STRK, USDC, USDT, WBTC and DAI. The deployer wallet used to stage the attack was created seven days prior, on September 10, and its transaction history shows a preparatory pattern: USDC approvals and CCTP burn deposits (bridging out via Circle's native mechanism), AVNU-routed swaps across STRK, WBTC and USDC, and multiple transfers and swaps involving Solv BTC — the exact token used in the manipulated NSTR/SolvBTC pool to distort the oracle. Approximately $1.92M (234.57 ETH plus 1.3M DAI) was confirmed bridged to Ethereum via CCTP. The primary borrow account still held roughly $1.82M in assets (ETH, STRK, WBTC, DAI) as of the last check, alongside open debt positions of 913.74 ETH, 27.59M STRK and 2.70 WBTC — consistent with the inflated-collateral borrowing mechanism. The Starknet Security Council has posted a public request for contact directly on the exploit account's page via the Voyager block explorer. The Nostra market remains frozen.