Malicious Rust Crates Steal Solana and Ethereum Keys — 8,424 Downloads Confirmed

Cybersecurity researchers uncovered two malicious Rust crates impersonating the legitimate library fast_log, named faster_log and async_println, published on May 25, 2025 by the threat actors behind the aliases rustguruman and dumbnbased. The campaigns amassed 8,424 downloads in total, according to Socket, and the crates include logging code used to embed routines that scan source files for Solana and Ethereum private keys, exfiltrating matches via HTTP POST to a hardcoded C2 endpoint.

The attackers relied on typosquatting and copied READMEs and repository fields to resemble the real project, with runtime execution occurring when a project depending on them was run or tested. Crates[.]io has removed the two packages and disabled the related accounts, while preserving logs for analysis. Crates[.]io’s Walter Pearce noted that, aside from the malicious payload, the crates copied the original code and documentation, and the campaign did not execute any malicious code at build time.

The C2 domain used was mainnet.solana-rpc-pool.workers[.]dev, and the effort highlights how minimal deception can create a supply chain risk for developer laptops and CI environments.