Nostra exploit: the $2M that reached Ethereum is still on one wallet — after a Railgun deposit came straight back

Nostra lets users borrow against collateral priced by an oracle. According to rekt.news, the attacker created a tiny NSTR/SolvBTC pool on Starknet, pushed its price to about $99, and the oracle averaged that with the real market price of about $0.006. The result valued the collateral at roughly 8,300 times what it was worth. Against it the attacker borrowed 939 ETH, 28.27M STRK, about $198,000 in USDC and USDT, 2.88 WBTC and 29,078 DAI — about $3.5 million.

The borrowing was done from Starknet account 0x06d48ef7…44bc3. Rekt.news reports that about $1.6 million stayed on Starknet and about $1.92 million was moved to Ethereum, ending in one wallet: 0xa059aaab82773caf622de9d9a0f2dbf9aa7f3c37. Everything below is that wallet, read on 3 October 2026.

The money arrived on the morning of 17 September in about thirty transfers between 05:53 and 08:31 UTC: 1,346,744 USDC issued through Circle’s cross-chain transfer, 7.43 WBTC through a LayerZero bridge adapter and about 23 ETH directly.

The USDC did not stay USDC. Within minutes of arriving, it was swapped batch by batch into DAI through CoW Protocol and the 0x settler — 1,347,821 DAI in total. That is the first thing the attacker did, and it is not an accident: Circle can freeze USDC on any address; nobody can freeze DAI. The WBTC was sold for 230.70 ETH the same afternoon.

At 12:25 UTC the wallet sent 19 ETH to a fresh address, 0x8F05Ee3d885F4b722b37E613cD002776418eFE40, which deposited it into the Railgun privacy pool two minutes later. At 13:32 the same address took 18.90 ETH back out of Railgun — to itself — and four minutes later passed it to another fresh address, 0xC5E77358fC7e4810713fD513d3a68934F5DB4912. Five days later, on 22 September, that address sent the 18.90 ETH straight back to the attacker’s main wallet.

A deposit that leaves a privacy pool to the address it came from, an hour after entering, has not been mixed. That round trip is what Railgun’s Private Proofs of Innocence does to a deposit it will not accept: the only way out is back to the sender. We cannot see Railgun’s decision, but the movement fits it, and no other attempt has been made since. Compare the Aave v3 Loop Safe Module attacker two weeks later, whose 114 ETH entered the same pool and stayed in.

On 3 October 0xa059aaab82773caf622de9d9a0f2dbf9aa7f3c37 holds 253.47 ETH and 1,347,821 DAI. Since 22 September it has made no outgoing transfer of either. Its history is now full of noise: fake “ETH” tokens and zero-value transfers from addresses that start with the same characters as the real ones — 0x8F05…, 0xC5E7…, 0xA059… — sent to trick anyone who copies an address from the history. Those are not part of the trail.

Because the money is in ETH and DAI, no issuer can freeze it. What can still stop it is the exit: any exchange or service that screens deposits will see where these coins came from. We have filed the wallet and its two relays.

It names nobody and does not say who controls any address. The mechanism, the loss figure and the Starknet accounts are rekt.news’ account; the Ethereum wallet’s history and balances are ours, read from the chain on 3 October 2026. We did not read the Starknet side ourselves.