Cyber

Zilliqa

Union

<p>The European Union has moved to tighten cybersecurity oversight for crypto wallet technology by requiring hardware and software wallet providers to report actively exploited bugs and severe vulnerabilities on very short timelines. The European Commission says the requirement takes effect under the EU’s Cyber Resilience Act (CRA), which entered into force on Friday.</p><p>Under the framework, affected providers must issue an early warning within 24 hours after becoming aware of certain security problems, then submit broader notifications within set deadlines. The rules apply to digital products made available in the EU, aiming to reduce the window in which consumers and businesses can be exposed to real-world attacks.</p><h2 id="key-takeaways">Key takeaways</h2><ul><li>Wallet providers must report severe vulnerabilities that are actively exploited within 24 hours, with fuller updates due later.</li><li>After corrective or mitigating measures are available, a final report is expected within 14 days; severe incidents may require updates within one month.</li><li>The EU’s CRA introduces potential administrative penalties of up to €15 million (about $17.3 million) or 2.5% of worldwide annual turnover, whichever is higher.</li><li>Supplying incorrect or misleading information to regulators can trigger additional fines of up to €5 million.</li><li>The announcement arrives amid recent wallet-related incidents and vulnerability disclosures that highlight the speed at which threats can spread.</li></ul><h2 id="what-the-cra-requires-after-a-serious-vulnerability-is-found">What the CRA requires after a serious vulnerability is found</h2><p>According to an announcement from the European Commission, the CRA’s reporting obligations are designed for fast-moving threats—particularly those already in use by attackers. The measure requires manufacturers of in-scope products to notify authorities when they are aware of “actively exploited” security weaknesses or “severe security vulnerabilities” impacting their offerings.</p><p>The timeline described by the Commission includes three main checkpoints: an early warning within 24 hours, a complete notification within 72 hours, and a final report after mitigations or corrections become available. The final reporting window is set at 14 days after corrective or mitigating measures are available. For severe incidents, the Commission also references a requirement to report within one month.</p><p>While the CRA is broader than crypto alone, the practical impact for the market is significant because many wallet products involve tightly coupled components—secure elements, wallet software, update systems, and integrations with user interfaces. In such systems, vulnerabilities can quickly translate into phishing campaigns, social engineering, or compromise of signing workflows.</p><h2 id="how-penalties-could-scale-for-non-compliance">How penalties could scale for non-compliance</h2><p>The Commission’s initiative is backed by enforcement measures. The penalties section of the CRA draft, referenced via the European Cyber Resilience Act article archive, states that companies failing to comply with requirements under Articles 13 and 14 may face an administrative fine of up to €15 million (approximately $17.3 million) or 2.5% of worldwide annual turnover, depending on which is higher.</p><p>There is also a separate risk for poor quality reporting. The draft’s penalties section provides for an administrative fine of up to €5 million for companies that submit “incorrect, incomplete or misleading information.” In practice, this creates an incentive not only to meet reporting deadlines, but to ensure that the information shared with regulators is accurate enough to support effective downstream risk management.</p><h2 id="why-the-timing-matters-for-crypto-wallet-users">Why the timing matters for crypto wallet users</h2><p>The EU’s action comes weeks after high-profile wallet security issues that demonstrate how quickly attackers can exploit trust and urgency. Earlier coverage from <a class="thirstylink" rel="noopener noreferrer nofollow" href="https://sovrn.co/1h8llaz">Cointelegraph</a> described how two popular hardware wallet providers disclosed data-related incidents that could enable phishing or social engineering attempts.</p><p>On Sept. 4, hardware wallet provider <a class="thirstylink" rel="noopener noreferrer nofollow" href="https://trezor.go2cloud.org/aff_c?offer_id=133&amp;aff_id=5607&amp;source=cryptobreaking">Trezor</a> disclosed that an additional 67,000 US customers were at risk stemming from a data breach suffered by its shipping provider, ShipMonk—exceeding an initially estimated 14,000 users. Shortly afterward, <a class="thirstylink" rel="noopener noreferrer nofollow" href="https://sovrn.co/1h8llaz">Cointelegraph</a> reported that <a class="thirstylink" rel="noopener noreferrer nofollow" href="https://trezor.go2cloud.org/aff_c?offer_id=133&amp;aff_id=5607&amp;source=cryptobreaking">Trezor</a> and BitBox warned users about phishing emails masquerading as urgent security notifications, linked to suspected compromises involving third-party email services.</p><p>Cointelegraph has also noted earlier vulnerability-related warnings affecting crypto users beyond wallet vendors. In June, Zilliqa warned that a vulnerability in the Zilliqa <a class="thirstylink" rel="noopener noreferrer nofollow" href="https://ledger.pxf.io/gO5AdA">Ledger</a> app could allow attackers to recover users’ private keys using publicly available on-chain data. While not directly the same category of event described in the CRA reporting rules, it illustrates how software components connected to wallet functionality can introduce risks that regulators and users increasingly expect to be communicated promptly.</p><p>The CRA’s short reporting windows are intended to reduce the gap between discovery and public or regulatory awareness. For wallet users, that could mean faster updates, clearer guidance about what to do next, and fewer days for attackers to ride the uncertainty created by breaches.</p><h2 id="wallet-makers-face-a-new-compliance-burden">Wallet makers face a new compliance burden</h2><p>The European Commission says the reporting requirements extend to all products “with digital elements made available in the EU,” positioning the CRA as an extension of the EU’s broader cybersecurity strategy. In the crypto space, compliance will likely require wallet providers and related manufacturers to establish tighter internal processes for identifying the severity of vulnerabilities, determining whether exploitation is underway, and coordinating notifications quickly.</p><p>Cointelegraph approached wallet makers Trezor and <a class="thirstylink" rel="noopener noreferrer nofollow" href="https://ledger.pxf.io/gO5AdA">Ledger</a> for comment on how wallet providers would comply with the new reporting requirements. How each company operationalizes the reporting timeline—particularly the 24-hour “awareness to report” window—could become an important differentiator for users, developers, and partners that depend on wallet security assurances.</p><p>One uncertainty for the market is how quickly manufacturers can reliably classify an issue as “actively exploited” versus a theoretical or unconfirmed risk, and what evidence will be considered adequate to trigger the fastest reporting track. As the CRA implementation develops, providers will also need to pay close attention to how regulators interpret product scope and responsibilities across the supply chain, especially when incidents originate in third-party services.</p><h2 id="what-to-watch-next">What to watch next</h2><p>As the CRA’s reporting deadlines take hold, wallet users and industry partners should watch for faster vulnerability disclosures, more structured incident communications, and clearer expectations around what constitutes “severe” issues and “active exploitation.” The real test will be whether providers can sustain the new timelines as vulnerabilities emerge—and whether regulators apply the penalties strictly for reporting gaps or inaccurate updates.</p><p>This article was originally published as <a href="https://www.cryptobreaking.com/eu-cybersecurity-rules-require-crypto/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">EU cybersecurity rules require crypto wallet makers’ 24-hour reporting</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.</p>

EU cybersecurity rules require crypto wallet makers’ 24-hour reporting

Table of Contents

Crypto Breaking News

Other articles published on Sep 14, 2026

Trump Says $5,000 Payments Are ‘Easy’ to Fund as Congress Questions $1.2 Trillion Cost

Robinhood CEO rejects issuer veto over stock tokens

The Politics of AI

WLFI Rallies Despite Negative Sentiment: What’s Driving the Volume Spike?

Based On This Grok Prediction, Pundit Says $40 XRP Price Is Now Inevitable

Crypto: In 2026, BNB Chain Emerges as the Global Leader in RWA Growth

Join our free newsletter for daily crypto updates!