Malicious Rust Crates Infect Supply Chain, Steal Crypto Wallet Keys in 2025
Executive Summary
In May 2025, cybersecurity researchers identified a major supply chain attack targeting the Rust developer ecosystem. Two malicious Rust crates—faster_log and async_println—were published on the popular crates.io repository, masquerading as legitimate packages but designed to covertly exfiltrate Solana and Ethereum wallet private keys from software projects that incorporated them. The threat actors, using the aliases rustguruman and dumbnbased, achieved over 8,400 downloads, heightening the risk of cryptographic asset theft and potentially impacting both individual developers and organizations reliant on decentralized finance.
This incident exemplifies the growing risks within open-source ecosystems, where attackers exploit trusted repositories to distribute malware. The trend of targeting crypto assets through developer-centric supply chain attacks highlights an urgent need for more robust vetting of third-party code and increased vigilance against evolving attacker tactics.
Why This Matters Now
Open-source supply chain attacks are on the rise, targeting not just enterprises but anyone relying on community software. With increasing adoption of blockchain and cryptocurrency technologies, stealing wallet keys via malicious developer packages presents immediate risk to a broad range of users and enterprises by bypassing traditional security controls.
Attack Path Analysis
Attackers initiated a supply chain compromise by publishing malicious Rust crates that impersonated a legitimate library, leading to developer systems or CI/CD environments unknowingly ingesting the trojan code. Once installed, the malware sought to access sensitive wallet key material, escalating privileges as needed to extract in-memory or persisted secrets. The malicious code remained stealthy, potentially moving laterally inside vulnerable environments if further resources were accessible. It established command and control via outbound connections to attacker infrastructure to signal successful infection. Stolen cryptocurrency keys were exfiltrated via outbound network traffic. Ultimately, the impact was the unauthorized theft of Solana and Ethereum assets from affected victims.
Kill Chain Progression
Initial Compromise
Description
Malicious Rust crates were uploaded to a public package repository and downloaded by unsuspecting developers or automated builds, introducing trojanized code into production environments.
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Command and Scripting Interpreter
Compromise Client Software Binary
Forge Web Credentials: Export Private Keys
Automated Collection
Exfiltration Over C2 Channel
Impair Defenses: Disable or Modify Tools
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Prevent Introduction of Malicious Code
Control ID: 6.3.4
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Third-Party Risk Management
Control ID: Article 8(2)
CISA Zero Trust Maturity Model 2.0 – Supply Chain Threat Detection and Incident Response
Control ID: Pillar: Supply Chain – Detect/Respond
NIS2 Directive – Supply Chain Security and Vulnerability Management
Control ID: Article 21 (2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply chain attacks targeting Rust crates directly compromise software development workflows, stealing cryptocurrency wallet keys from source code during build processes.
Financial Services
Malicious crates targeting Solana and Ethereum wallet keys pose critical risks to cryptocurrency operations, digital asset management, and blockchain-based financial services.
Information Technology/IT
IT organizations using Rust development frameworks face elevated supply chain risks from typosquatting attacks compromising legitimate logging libraries in production systems.
Biotechnology/Greentech
Biotech firms leveraging blockchain for research data integrity and cryptocurrency transactions are vulnerable to wallet key theft through compromised development dependencies.
Sources
- Malicious Rust Crates Steal Solana and Ethereum Keys — 8,424 Downloads Confirmedhttps://thehackernews.com/2025/09/malicious-rust-crates-steal-solana-and.htmlVerified
- crates.io: Malicious crates faster_log and async_println | Rust Bloghttps://blog.rust-lang.org/2025/09/24/crates.io-malicious-crates-fasterlog-and-asyncprintln/Verified
- Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keyshttps://socket.dev/blog/two-malicious-rust-crates-impersonate-popular-logger-to-steal-wallet-keysVerified
- Malicious Rust packages on Crates.io steal crypto wallet keyshttps://www.bleepingcomputer.com/news/security/malicious-rust-packages-on-cratesio-steal-crypto-wallet-keys/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying Zero Trust controls such as micro-segmentation, stringent egress filtering, anomaly detection, and layered traffic security would have constrained malware propagation, blocked unauthorized data exfiltration, and improved detection of suspicious outbound activity. CNSF capabilities enforce least privilege, granular policy enforcement, and real-time monitoring, drastically limiting exposure during supply chain attacks.
Control: Zero Trust Segmentation
Mitigation: Limits initial malware reach by tightly controlling workload communication paths.
Control: Multicloud Visibility & Control
Mitigation: Provides detailed visibility into privilege assignments and resource access.
Control: East-West Traffic Security
Mitigation: Prevents and detects unauthorized inter-workload communications.
Control: Cloud Firewall (ACF)
Mitigation: Blocks or alerts on suspicious outbound C2 channels.
Control: Egress Security & Policy Enforcement
Mitigation: Detects and blocks exfiltration attempts to unknown or unapproved destinations.
Enables rapid incident response to limit ongoing asset theft.
Impact at a Glance
Affected Business Functions
- Software Development
- Cryptocurrency Management
Estimated downtime: 7 days
Estimated loss: $500,000
The malicious crates 'faster_log' and 'async_println' scanned developers' source code for Solana and Ethereum private keys, exfiltrating them to an attacker-controlled server. This led to unauthorized access to cryptocurrency wallets, resulting in potential financial losses and compromised sensitive data.
Recommended Actions
Key Takeaways & Next Steps
- • Harden supply chain intake with strict segmentation and workload egress controls to prevent unauthorized dependency fetching.
- • Enforce egress policy and outbound traffic monitoring to detect and block exfiltration of sensitive keys or credentials.
- • Deploy microsegmentation (Zero Trust Segmentation) across cloud workloads, restricting unnecessary east-west communication between build, dev, and production environments.
- • Implement continuous threat detection and anomaly response to swiftly identify and contain malware infections in cloud-native environments.
- • Enhance multicloud security visibility and automated policy management to rapidly detect, investigate, and remediate privilege abuse or policy violations.
