EU cyber rules impose 24‑hour reporting deadline on crypto wallet makers

The European Union’s Cyber Resilience Act (CRA) now requires hardware and software crypto‑wallet providers to report actively exploited security flaws within 24 hours of discovery, followed by a full notification within 72 hours.

Reporting timeline and penalties

Under Articles 13 and 14 of the CRA, manufacturers must:

• Submit an early‑warning notice for severe vulnerabilities within 24 hours of awareness.
• Provide a comprehensive notification within 72 hours.
• Deliver a final report within 14 days after corrective measures are available, or within one month for severe incidents.

Failure to comply can result in administrative fines of up to €15 million (approximately $17.3 million) or 2.5 % of worldwide annual turnover, whichever is higher. Supplying incorrect or incomplete information may attract fines of up to €5 million.

Context and recent incidents

The new rules come after several high‑profile security incidents involving wallet providers:

• Trezor disclosed that an additional 67,000 U.S. customers were exposed due to a breach at its shipping partner, ShipMonk.
• Both Trezor and BitBox warned users of phishing emails masquerading as urgent security notices.
• Zilliqa reported a vulnerability in its Ledger app that could allow attackers to recover private keys using on‑chain data.

These events highlighted the need for faster vulnerability disclosure to protect consumers and businesses.

Industry response

The European Commission has invited comments from wallet makers, including Trezor and Ledger, on how they will adapt to the new reporting obligations.