EU Cyber Resilience Act Puts Crypto Wallet Makers on a 24-Hour Security Disclosure Clock

EU’s Cyber Resilience Act Now Forces Wallet Makers to Alert Authorities Within 24 Hours of an Active Exploit

Crypto wallet manufacturers selling into the European Union now face a strict three-stage reporting clock when a serious security event hits their products. Under the EU’s Cyber Resilience Act, or CRA, commercial makers of connected hardware wallets and wallet software must warn cyber authorities within 24 hours of discovering an actively exploited vulnerability or a severe security incident. The rapid reporting duty took effect on September 11, 2026, according to the European Commission’s reporting guidance, and it applies to manufacturers of products with digital elements across the single market.

The rule lands squarely on an industry that has repeatedly struggled with disclosure timing. From hardware wallet data breaches to fake government data requests that pulled Bitcoin transaction histories out of fintech platforms, the crypto sector has seen a string of incidents in recent years where users learned of exposures days or weeks after the fact. The CRA compresses that window dramatically for qualifying products.

What the Cyber Resilience Act actually covers

The CRA is a horizontal product law rather than crypto-specific legislation. The Commission’s implementation FAQ states that it applies to hardware and software made available on the EU market, with a legal test requiring that the product’s intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. A commercially supplied connected hardware wallet or a downloadable wallet app can meet that test.

However, EU guidance does not name wallet brands and does not declare every wallet service or project covered. Coverage depends on the specific product, how it is supplied, and whether any exclusion applies. Self-custody software distributed without commercial supply, for instance, sits in a different position than a paid hardware device sold through European retailers.

The reporting duty also reaches in-scope products that were already on the market. That makes the new clock relevant to existing product lines, not only wallets first sold after the broader law takes effect on December 11, 2027.

The three-stage reporting timeline

The first filing is an early warning, due without undue delay and no later than 24 hours after a manufacturer becomes aware of the vulnerability or incident. The early warning must indicate, where applicable, the member states where the product is known to have been made available. For a severe incident, the warning must also state whether unlawful or malicious acts are suspected.

A fuller notification is due within 72 hours, unless the relevant information was already provided. For an actively exploited vulnerability, that filing must add general information about the product, the exploit and the vulnerability, together with corrective or mitigating measures. For a severe incident, it adds the nature of the incident, an initial assessment, and available mitigation information.

The final deadlines differ by event type. A vulnerability report is due no later than 14 days after a corrective or mitigating measure becomes available. The severe-incident final report deadline is set at one month after the 72-hour notification, as detailed in the regulation itself.

One portal, ENISA, and duties to users

Manufacturers file once through the Single Reporting Platform launched by ENISA, the EU cybersecurity agency. The portal routes the notification to the designated coordinating Computer Security Incident Response Team, makes the information available to ENISA, and supports distribution to other relevant national teams across the bloc. The single-entry design is meant to spare manufacturers from filing separately in multiple member states.

Beyond the regulator-facing obligations, manufacturers must also inform impacted users and, where appropriate, all users when action is needed, including the measures users can take themselves. For wallet makers, that user-notification duty could prove just as consequential as the filings, since a compromised seed phrase or private key requires immediate user action to prevent loss of funds.

Open source is not a blanket exemption

One of the sharpest edges of the new regime concerns open-source software, which underpins much of the wallet ecosystem. The Commission’s open-source guidance says commercially supplied free and open-source products can face manufacturer obligations. Non-monetized software supplied by its manufacturer should not count as commercial activity, and individual contributors are not treated as manufacturers for software outside their responsibility.

Open-source software stewards are a separate legal category under the law, and their reporting duties begin on December 11, 2027. That is also when the CRA’s main product-security requirements take effect. The September 11 change starts only the rapid reporting regime, not the law’s broader secure-design and product-lifecycle framework.

Why it matters for crypto

For an industry where disclosure has often been voluntary, slow, or negotiated privately with security researchers, the CRA introduces hard legal deadlines with pan-European reach. Wallet vendors operating in the EU market will need incident-response processes capable of producing a regulator-ready early warning inside 24 hours, a pace many traditional security teams would find demanding.

The obligations also arrive amid heightened scrutiny of crypto-adjacent cyber incidents in Europe, from exchange breaches to phishing campaigns targeting wallet users. Whether the 24-hour clock meaningfully improves user protection will depend on enforcement, but the era of quiet, delayed wallet vulnerability disclosure in the EU market has formally ended.