EU cybersecurity rules require crypto wallet makers’ 24-hour reporting

The European Union has moved to tighten cybersecurity oversight for crypto wallet technology by requiring hardware and software wallet providers to report actively exploited bugs and severe vulnerabilities on very short timelines. The European Commission says the requirement takes effect under the EU’s Cyber Resilience Act (CRA), which entered into force on Friday.

Under the framework, affected providers must issue an early warning within 24 hours after becoming aware of certain security problems, then submit broader notifications within set deadlines. The rules apply to digital products made available in the EU, aiming to reduce the window in which consumers and businesses can be exposed to real-world attacks.

Key takeaways

• Wallet providers must report severe vulnerabilities that are actively exploited within 24 hours, with fuller updates due later.
• After corrective or mitigating measures are available, a final report is expected within 14 days; severe incidents may require updates within one month.
• The EU’s CRA introduces potential administrative penalties of up to €15 million (about $17.3 million) or 2.5% of worldwide annual turnover, whichever is higher.
• Supplying incorrect or misleading information to regulators can trigger additional fines of up to €5 million.
• The announcement arrives amid recent wallet-related incidents and vulnerability disclosures that highlight the speed at which threats can spread.

What the CRA requires after a serious vulnerability is found

According to an announcement from the European Commission, the CRA’s reporting obligations are designed for fast-moving threats—particularly those already in use by attackers. The measure requires manufacturers of in-scope products to notify authorities when they are aware of “actively exploited” security weaknesses or “severe security vulnerabilities” impacting their offerings.

The timeline described by the Commission includes three main checkpoints: an early warning within 24 hours, a complete notification within 72 hours, and a final report after mitigations or corrections become available. The final reporting window is set at 14 days after corrective or mitigating measures are available. For severe incidents, the Commission also references a requirement to report within one month.

While the CRA is broader than crypto alone, the practical impact for the market is significant because many wallet products involve tightly coupled components—secure elements, wallet software, update systems, and integrations with user interfaces. In such systems, vulnerabilities can quickly translate into phishing campaigns, social engineering, or compromise of signing workflows.

How penalties could scale for non-compliance

The Commission’s initiative is backed by enforcement measures. The penalties section of the CRA draft, referenced via the European Cyber Resilience Act article archive, states that companies failing to comply with requirements under Articles 13 and 14 may face an administrative fine of up to €15 million (approximately $17.3 million) or 2.5% of worldwide annual turnover, depending on which is higher.

There is also a separate risk for poor quality reporting. The draft’s penalties section provides for an administrative fine of up to €5 million for companies that submit “incorrect, incomplete or misleading information.” In practice, this creates an incentive not only to meet reporting deadlines, but to ensure that the information shared with regulators is accurate enough to support effective downstream risk management.

Why the timing matters for crypto wallet users

The EU’s action comes weeks after high-profile wallet security issues that demonstrate how quickly attackers can exploit trust and urgency. Earlier coverage from Cointelegraph described how two popular hardware wallet providers disclosed data-related incidents that could enable phishing or social engineering attempts.

On Sept. 4, hardware wallet provider Trezor disclosed that an additional 67,000 US customers were at risk stemming from a data breach suffered by its shipping provider, ShipMonk—exceeding an initially estimated 14,000 users. Shortly afterward, Cointelegraph reported that Trezor and BitBox warned users about phishing emails masquerading as urgent security notifications, linked to suspected compromises involving third-party email services.

Cointelegraph has also noted earlier vulnerability-related warnings affecting crypto users beyond wallet vendors. In June, Zilliqa warned that a vulnerability in the Zilliqa Ledger app could allow attackers to recover users’ private keys using publicly available on-chain data. While not directly the same category of event described in the CRA reporting rules, it illustrates how software components connected to wallet functionality can introduce risks that regulators and users increasingly expect to be communicated promptly.

The CRA’s short reporting windows are intended to reduce the gap between discovery and public or regulatory awareness. For wallet users, that could mean faster updates, clearer guidance about what to do next, and fewer days for attackers to ride the uncertainty created by breaches.

Wallet makers face a new compliance burden

The European Commission says the reporting requirements extend to all products “with digital elements made available in the EU,” positioning the CRA as an extension of the EU’s broader cybersecurity strategy. In the crypto space, compliance will likely require wallet providers and related manufacturers to establish tighter internal processes for identifying the severity of vulnerabilities, determining whether exploitation is underway, and coordinating notifications quickly.

Cointelegraph approached wallet makers Trezor and Ledger for comment on how wallet providers would comply with the new reporting requirements. How each company operationalizes the reporting timeline—particularly the 24-hour “awareness to report” window—could become an important differentiator for users, developers, and partners that depend on wallet security assurances.

One uncertainty for the market is how quickly manufacturers can reliably classify an issue as “actively exploited” versus a theoretical or unconfirmed risk, and what evidence will be considered adequate to trigger the fastest reporting track. As the CRA implementation develops, providers will also need to pay close attention to how regulators interpret product scope and responsibilities across the supply chain, especially when incidents originate in third-party services.

What to watch next

As the CRA’s reporting deadlines take hold, wallet users and industry partners should watch for faster vulnerability disclosures, more structured incident communications, and clearer expectations around what constitutes “severe” issues and “active exploitation.” The real test will be whether providers can sustain the new timelines as vulnerabilities emerge—and whether regulators apply the penalties strictly for reporting gaps or inaccurate updates.