Supply Chain Attack: Malicious Rust Crates Steal Solana and Ethereum Private Keys

Socket’s Threat Research Team uncovered a supply chain attack involving two malicious Rust crates—faster_log and async_println—that impersonated the legitimate fast_log library. The impostor packages were downloaded more than 8,400 times before being removed from the Rust package registry, and the threat actor, operating under the aliases rustguruman and dumbnbased, published the crates on May 25, 2025.

Both crates included working logging code to avoid suspicion but secretly embedded routines to scan Rust projects for cryptocurrency wallet secrets, with exfiltration occurring via HTTP POST to a hardcoded command and control (C2) endpoint (https://mainnet[.]solana-rpc-pool[.]workers[.]dev/). The malicious logic searched for Ethereum private keys, Solana Base58 addresses and keys, and bracketed byte arrays that may contain raw key material, packaging data alongside the file path and line number for the attacker.

Following Socket’s disclosure, the Crates[.]io security team acted swiftly—preserving all faster_log and async_println files for analysis, removing the listings, locking the attacker accounts, and publishing an official security advisory detailing their actions.