EU cyber rules force wallet makers into 24-hour reporting

Crypto wallet makers operating in the European Union are now under a much tighter cyber reporting regime. The bloc’s new rules require providers of hardware and software wallets to move fast when they detect actively exploited bugs or serious security weaknesses. Missing the deadlines could leave firms exposed to administrative fines of up to $17.3 million.

Tight deadlines for security disclosures

Under the European Commission’s framework, firms must send an early warning within 24 hours of becoming aware of a severe vulnerability. A fuller notification is due within 72 hours, followed by a final report 14 days after corrective or mitigating steps become available. For severe incidents, another deadline applies within one month.

The reporting obligations are part of the Cyber Resilience Act, which took effect on Friday, according to the European Commission. The measure is aimed at improving protection for consumers and businesses that rely on connected products and digital services. For wallet providers, the change means cyber incidents must now be escalated far more quickly than under looser disclosure practices.

What the rule change means for wallets

The new timetable brings crypto wallet makers closer to the kind of incident reporting discipline already familiar in other regulated technology sectors. Hardware and software wallet providers will need internal processes that can identify whether a flaw is being actively exploited, assess its severity and start the notification chain almost immediately. That creates a practical compliance burden as well as a legal one.

The Commission’s approach reflects concern that delayed reporting can leave users exposed while attackers continue to exploit the same weakness. By forcing early disclosure, EU authorities are trying to shorten the window in which harmful code can spread or customer assets can be put at risk. The policy also puts more emphasis on documentation, since the later filings are meant to show what was found and what was done about it.

For the crypto industry, the rule reinforces that wallet products are not outside the bloc’s broader cybersecurity agenda. Firms selling into the EU will need to treat vulnerability management as a time-sensitive regulatory process, not just a technical response. The result is likely to be stricter compliance systems, faster escalation procedures and more formal coordination between engineering, legal and security teams.

This article is not investment advice and recommends no asset, level or direction; a single session's move is not evidence of a trend. For background see Crypto, Altcoin, Bitcoin, and for terms the finance glossary.