borrowed against collateral reconstructed at about $421
Nostra; independent reconstructionNostra: Oracle Manipulation on Starknet
A thin pool, a ninety-nine dollar quote and an oracle that returned the midpoint. The exploit happened on Starknet, which Forensia does not read, so the film reports that part with its sources and starts its own record where the money lands on Ethereum.
- Date
- September 17, 2026
- Network
- Ethereum
- Reported amount
- $3.5Mborrowed from Nostra against its own token
- What happened
- Oracle price manipulation on Starknet, read from where the funds reach Ethereum
- Status
- Post-mortem promised (reported)
- This file rests on
- 7 recorded and 12 reported statementsacross 4 linked identifiers
12 chapters · choose one to jump the film to it
Replay it yourself.
These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.
The loan
On September 17 one account borrowed about 3.5 million dollars from Nostra, a lending protocol on Starknet. By one reconstruction its collateral was worth about four hundred dollars.
Reported by others- One account borrowed roughly $3.5M against inflated NSTR collateral.Nostra
- The collateral's clean-market value was about $421.Independent reconstruction
One: a new pool
The attacker creates a new trading pool for Nostra's own token, NSTR. Thin liquidity, placed on one side.
Reported by others- A new NSTR pool was created and seeded with one-sided liquidity.BlockSec
Two: the price move
A small trade in that pool moves its quoted price from under one cent to ninety-nine dollars.
Reported by others- A small trade moved the pool's NSTR quote from under one cent to about $99.BlockSec
Three: the oracle
The price oracle had two sources that morning. One said 0.6 cents. One said ninety-nine dollars. It returned the midpoint: $49.52.
Reported by others- Two sources contributed: about $0.00596 and about $99.02.Pragma
- The value returned to the market was the midpoint, about $49.52.Independent reconstruction
Four: the borrow
About seventy thousand NSTR is posted as collateral. Seven borrow transactions take six assets. The largest is about 939 ETH.
Reported by others- About 70,686 NSTR was posted as collateral.Independent reconstruction
- The largest borrow, about 939 ETH, is on a public Starknet node.Public Starknet node, checked for the film
The response
Nostra paused its market and confirmed the figure. The oracle provider, Pragma, says a three-source minimum would have rejected that price.
Reported by others- The money market was paused and a post-mortem promised.Nostra
- A three-source minimum would have rejected the response.Pragma
Where this record starts
All of that happened on Starknet, which Forensia does not cover. Its record starts where the money reaches Ethereum.
Five: the Ethereum address
From 06:11 UTC funds arrive at this Ethereum address. The lookup returns thirty-two records, a balance of almost nothing, and one lead: look-alike counterparty addresses.
Recorded · captured October 6, 2026- 32 records retrieved: 4 in, 28 out.
- A balance of 0.000024 ETH.
- One lead: 1 set of look-alike counterparty addresses.
Reported by othersOpens a live lookup on the Summary view. Today’s capture may differ from the film’s.- Arrivals on Ethereum begin at 06:11 UTC on September 17.Public explorer
Six: it moves
It held for seventeen days. Then, on October 4, it moved. This is one of the transfers: 547 thousand DAI to a new address.
Recorded · captured October 6, 2026Opens a live lookup on the Activity view. Today’s capture may differ from the film’s.- 1 outgoing token transfer: 547,821.44562725 DAI to 0x916620…1200B0.
The other transfers
Three transfers took 1.35 million DAI. A fourth took 243 ETH.
Recorded · captured October 6, 2026- 0xA059Aa…7F3c37 sent 243.474441 ETH to 0x916620…1200B0.
Reported by othersOpens a live lookup on the Summary view. Today’s capture may differ from the film’s.- Three DAI transfers of 300,000, 500,000 and 547,821.45 total 1,347,821.45 DAI.Public explorer
Seven: the new address
The new address holds 253 ETH and has sent nothing. As of October 6 it has not moved again.
Recorded · captured October 6, 2026Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.- A balance of 253.474442 ETH.
- A nonce of 0: no outgoing transactions.
Not known
Who controls these addresses. Whether anything will be recovered. Nostra has promised a post-mortem.
What the headline said. What a closer reading shows.
in a new Ethereum address with no outgoing transactions
Recorded in the lookupThe incident on one map
Who called what, and where it went.
Recorded in the workspaceReported by others
In the order it happened.
A thin NSTR pool is created and its quote pushed to about $99.Reported by others
Seven borrow transactions take about $3.5M in six assets from Nostra.Reported by others
Funds begin arriving at an Ethereum address.Reported by others
547,821.45 DAI, then 243.47 ETH, leave for a new address.Recorded
The new address holds 253.47 ETH and has sent nothing.Recorded
The cast
Open the investigation ↗Every address and transaction in this case.
Grouped by their place in the records. A group says what an address did here, not who controls it. Supported identifiers open as live lookups.
Where it went
Addresses that received the value. Who controls them is not established here.
- The Ethereum arrival addressEthereum address
Where the funds are reported to arrive from Starknet. It held for seventeen days, then moved.
- The new addressEthereum address
Received the October 4 transfers. No outgoing transactions when captured.
The transactions
The individual records each step of the case rests on.
- One of the DAI transfersEthereum transaction
547,821.45 DAI to a new address on October 4.
- The ETH transferEthereum transaction
243.47 ETH to the same new address, a minute later.
Two kinds of statement, kept apart.
Recorded statements were read in the workspace on October 6, 2026. Reported statements come from the source named beside each one and were not verified by Forensia. Everything on Starknet is reported, not observed. The record here starts at the Ethereum arrival and stops at an address that has not sent a transaction.
What the chain records7
- Step 8
32 records retrieved: 4 in, 28 out.
- Step 8
A balance of 0.000024 ETH.
- Step 8
One lead: 1 set of look-alike counterparty addresses.
- Step 9
1 outgoing token transfer: 547,821.44562725 DAI to 0x916620…1200B0.
- Step 10
0xA059Aa…7F3c37 sent 243.474441 ETH to 0x916620…1200B0.
- Step 11
A balance of 253.474442 ETH.
- Step 11
A nonce of 0: no outgoing transactions.
What others have reported12
- Step 1
One account borrowed roughly $3.5M against inflated NSTR collateral.Nostra
- Step 1
The collateral's clean-market value was about $421.Independent reconstruction
- Step 2
A new NSTR pool was created and seeded with one-sided liquidity.BlockSec
- Step 3
A small trade moved the pool's NSTR quote from under one cent to about $99.BlockSec
- Step 4
Two sources contributed: about $0.00596 and about $99.02.Pragma
- Step 4
The value returned to the market was the midpoint, about $49.52.Independent reconstruction
- Step 5
About 70,686 NSTR was posted as collateral.Independent reconstruction
- Step 5
The largest borrow, about 939 ETH, is on a public Starknet node.Public Starknet node, checked for the film
- Step 6
The money market was paused and a post-mortem promised.Nostra
- Step 6
A three-source minimum would have rejected the response.Pragma
- Step 8
Arrivals on Ethereum begin at 06:11 UTC on September 17.Public explorer
- Step 10
Three DAI transfers of 300,000, 500,000 and 547,821.45 total 1,347,821.45 DAI.Public explorer
Share and cite
Take the case with you.
The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.