Crypto wallet creators now have just 24 hours to alert regulators when flaws are exploited

02 Full notifications are due within 72 hours of awareness, with separate final-report deadlines.

03 Main product-security duties and open-source steward reporting begin Dec. 11, 2027.

Commercial manufacturers whose connected hardware wallets or wallet software meet the European Union's product test must now warn cyber authorities within 24 hours of discovering an actively exploited vulnerability or severe security incident.

The requirement took effect Sept. 11, 2026, under the EU's Cyber Resilience Act, or CRA. The European Commission's reporting guidance says the clock applies to manufacturers of products with digital elements.

The CRA is a horizontal product law. The Commission's implementation FAQ says it applies to hardware and software made available on the EU market. The legal test also requires the product's intended or reasonably foreseeable use to include a direct or indirect data connection to a device or network.

A commercially supplied connected hardware wallet or downloadable wallet app can meet that test. However, EU guidance does not name wallet brands or declare every wallet service or project covered. Coverage depends on the specific product, how it is supplied and any applicable exclusion.

SafePal breach exposes 40,000 customers as hardware wallet attacks escalate from data leaks to $100 million theft

What manufacturers must report

The first filing is an early warning due without undue delay and no later than 24 hours after a manufacturer becomes aware of the vulnerability or incident. It must indicate, where applicable, the member states where the product is known to have been made available. For a severe incident, the warning must also say whether unlawful or malicious acts are suspected.

A fuller notification is due within 72 hours unless the relevant information was already provided. For an actively exploited vulnerability, that filing adds general information the product, exploit and vulnerability, plus corrective or mitigating measures. For a severe incident, it adds the nature of the incident, an initial assessment and available mitigation information.

Zilliqa points to hardware wallet flaw discarding entropy to expose crypto keys, enabling 683M ZIL theft

The final deadline differs by event. A vulnerability report is due no later than 14 days after a corrective or mitigating measure becomes available. The CRA sets the severe-incident final report deadline at one month after the 72-hour notification, as detailed in the regulation .

Manufacturers file once through the Single Reporting Platform launched by ENISA , the EU cybersecurity agency. The portal sends the notification to the designated coordinating Computer Security Incident Response Team and makes the information available to ENISA, then supports distribution to other relevant national teams. Manufacturers must also inform impacted users and, where appropriate, all users when action is needed, including measures they can take.

No dice? Your Bitcoin hardware wallet is probably not as secure as you thought it was

The reporting rule reaches in-scope products placed on the market before Dec. 11, 2027. That makes the new clock relevant to existing product lines, not only wallets first sold after the broader law takes effect.

Open-source licensing does not create a blanket exemption. The Commission's open-source guidance says commercially supplied free and open-source products can face manufacturer obligations. Non-monetized software supplied by its manufacturer should not count as commercial activity, while individual contributors are not treated as manufacturers for software outside their responsibility.

Open-source software stewards are a separate legal category, and their reporting duties begin Dec. 11, 2027. That is also when the CRA's main product-security requirements take effect. The Sept. 11 change starts the rapid reporting regime, not the law's broader secure-design and product-lifecycle framework.

Also known as "Akiba," Liam Wright is a reporter, podcast producer, and Editor-in-Chief at CryptoSlate. He believes that decentralized technology has the potential to make…

CryptoSlate may use AI tools to support research, editing, and production workflows. Our journalism remains human-led, with our editorial team responsible for every published article. Read our full AI usage disclaimer .

Our writers' opinions are solely their own and do not reflect the opinion of CryptoSlate. None of the information you read on CryptoSlate should be taken as investment advice, nor does CryptoSlate endorse any project that may be mentioned or linked to in this article.

Buying and trading cryptocurrencies should be considered a high-risk activity. Please do your own due diligence before taking any action related to content within this article. Finally, CryptoSlate takes no responsibility should you lose money trading cryptocurrencies. For more information, see our company disclaimers .