Cybersecurity researchers have uncovered a sophisticated supply chain attack targeting cryptocurrency developers through malicious Rust programming packages. Two fake libraries designed to steal digital wallet credentials were recently discovered and removed from the official Rust package registry.
## The Attack Details
Security firm Socket identified two malicious packages—**faster_log** and **async_println**—that impersonated the legitimate **fast_log** library. Published on May 25, 2025, by threat actors using the aliases “rustguruman” and “dumbnbased,” these packages accumulated over 8,400 downloads before being detected.
“The crates include working logging code for cover and embed routines that scan source files for Solana and Ethereum private keys,” explained security researcher Kirill Boychenko. The malicious code would then transmit any discovered wallet keys to a command-and-control server via HTTP requests.
## How the Deception Worked
The attackers employed a **typosquatting strategy**, creating packages with names similar to the legitimate fast_log library. To avoid detection, they:
– Copied the original library’s documentation and README files
– Maintained full logging functionality as a cover
– Used deceptive domain names like “mainnet.solana-rpc-pool.workers.dev” to mimic legitimate Solana network endpoints
– Executed malicious code only during runtime, not during the build process
The malware specifically targeted **Ethereum and Solana private keys** by scanning Rust source files (*.rs) and searching for bracketed byte arrays containing wallet credentials.
## Response and Mitigation
Following responsible disclosure, crates.io maintainers quickly removed both packages and disabled the associated accounts. Walter Pearce from crates.io confirmed that “the malicious code was executed at runtime, when running or testing a project depending on them.”
Fortunately, the packages had no downstream dependencies, limiting the potential impact. However, the GitHub accounts linked to the publishers remain accessible, highlighting ongoing security concerns.
## Key Takeaways
This incident demonstrates how **minimal code changes and social engineering** can create significant supply chain risks. As Boychenko noted, “A functional logger with a familiar name, copied design, and README can pass casual review” while secretly compromising sensitive cryptocurrency credentials.
**Developers should:**
– Carefully verify package names and publishers before installation
– Review package source code, especially for security-sensitive applications
– Monitor for unusual network activity in development environments
– Use dependency scanning tools to identify potentially malicious packages
This attack underscores the critical importance of supply chain security in the cryptocurrency development ecosystem, where stolen private keys can result in immediate and irreversible financial losses.