Crates.io Alert: Rust Packages Stealing Crypto Wallet Keys

[johny899]

Hello, Rust and crypto enthusiasts. Here’s an alarming tale. Two Rust packages on Crates.io were nefariously searching for crypto wallets keys on the computers of developers. If you had downloaded a Rust crate and hadn’t checked it, you could be the victim.

The malicious packages​

The two malicious packages were called faster_log and async_println and were released on May 25, 2025. To seem safe, they copied the files and metadata of a legitimate package named fast_log.

• faster_log: 7200 downloads
• async_println: 1200 downloads
• Total: about 8500 downloads.

The security company Socket discovered the malware and contacted Crates.io. The site removed the crates and banned the publishers ('rustguruman' and 'dumbnbased') on September 24.

How the assault was executed​

The virus targeted:

• Ethereum private keys (hexadecimal strings)
• Solana keys/addresses (Base58 strings)
• Other crypto wallet seeds in files

Upon locating these keys and seeds, it sent the information, which included the files' names and lines numbered, to a malicious Cloudflare server. That server was not legitimate and owned by the hackers.

What to do if you were impacted​

The encouraging part about this situation is that there were no dependent crates, and the publishers did not release any additional malware.

If you have used either of the crates, you should:

• Uninstall any malicious packages from your computer
• Move your cryptocurrencies to new wallets.
• Only use packages from verified publishers
• Validate and verify build instructions to avoid unsafe code.

Lessons learned for developers​

This incident shows that official open source libraries can still be dangerous. A package or library that appears to be safe could be hiding malware designed to target your crypto keys. Always be vigilant and verify everything before installing anything on your computer.

Final thoughts​

Your crypto and your code deserve protection. If you have learned anything from this Rust package experience, it is that there are sneaky ways for attackers to enter your computer environment. Be vigilant, verify each and every package you use, don't trust blindly, and don't trust anything you install off the Crates.io website or anywhere else for that matter.