Malicious Rust Crates Steal Solana and Ethereum Keys — 8,424 Downloads Confirmed
Researchers studying cybersecurity have found two malicious Rust crates that grab Ethereum wallet keys and Solana wallet keys from source code by posing as the genuine library fast_log.
According to software supply chain security company Socket, the threat actor uploaded the crates, named faster_log and async_println, under the pseudonym rustguruman and dumbnbased on May 25, 2025, and they have had 8,424 downloads overall.
Kirill Boychenko, a security researcher, stated that the crates contain functional logging code for cover and embed routines that search source files for Solana and Ethereum private keys and then exfiltrate matches via HTTP POST to a hardcoded command and control (C2) endpoint securely.
The maintainers of crates.io have taken action to disable the two accounts ...