$3.5 Million Against $550,000 of Collateral: How to Check Which Tokens Your DeFi Lending Market Accepts

If you have funds sitting in a decentralised lending market, your risk is not decided by the interest rate but by the list of tokens the protocol accepts as collateral. On September 17, 2026, an attacker on Starknet exploited exactly that list and borrowed around 3.5 million US dollars from the Nostra Finance money market. The collateral was the protocol's own token NSTR, whose entire circulating market capitalisation stood between 550,000 and 590,000 US dollars at the time. The borrowed amount exceeded the market value of the posted collateral by more than five times. This article explains what is technically new about the incident and what is not — and above all, which four figures you can look up in the documentation of your own lending market before you next put money into it. The check takes about ten minutes and requires no expertise in blockchain programming. What happened on Starknet on September 17: $3.5 million against $550,000 of market value Nostra Finance runs a money market on the Ethereum scaling solution Starknet. That is a protocol where users deposit tokens and other users take out loans against posted collateral. The protocol reported the incident on September 17, 2026 at 13:28 UTC through its official channel. A single account had treated an inflated NSTR balance as collateral and then borrowed a basket of far more liquid assets: Ether, STRK, USDC, USDT, WBTC and DAI in the first version. The security firm PeckShield reported on September 18 at 00:41 UTC that around 1.92 million US dollars had been moved to the Ethereum mainnet, specifically 234.57 Ether and 1.3 million DAI. CertiK arrived at a similar split barely two hours later: roughly 1.55 million US dollars initially remained on Starknet, and around 1.93 million was bridged. The analytics firm SlowMist classified the event as oracle manipulation. Nostra itself has switched off deposits, borrowing, withdrawals and liquidations while the team reconciles the pool balances. How large the final loss turns out to be, and how much of it can be recovered, remains open. Oracle manipulation explained: how a price feed becomes the attack surface An oracle is the interface through which a protocol learns what a token is currently worth. Without that information a lending market cannot operate: it has to know how much a posted collateral covers and at what point a position must be liquidated. Oracle manipulation is an attack in which it is not the protocol's program code that is broken, but the price that this code takes at face value. The distinction matters, because it explains why security audits of the code help little here. The protocol calculates correctly — it merely calculates with a false number.