EU’s Cyber Resilience Act forces crypto wallet makers to report exploited flaws within 24 hours

The useful part

02 Full notifications are due within 72 hours of awareness, with separate final-report deadlines. 03 Main product-security duties and open-source steward reporting begin Dec. Commission's reporting guidance says the clock applies to manufacturers of products with digital elements.

How it works

• The legal test also requires the product's intended or reasonably foreseeable use to include a direct or indirect data connection to a device or network.
• However, EU guidance does not name wallet brands or declare every wallet service or project covered.
• Coverage depends on the specific product, how it is supplied and any applicable exclusion.
• Manufacturers must also inform impacted users and, where appropriate, all users when action is needed, including measures they can take.
• 11 change starts the rapid reporting regime, not the law's broader secure-design and product-lifecycle framework.

What to take from it

Buying and trading cryptocurrencies should be considered a high-risk activity. The Commission's implementation FAQ says it applies to hardware and software made available on the EU market. A commercially supplied connected hardware wallet or downloadable wallet app can meet that test.

Example or evidence

• Our journalism remains human-led, with our editorial team responsible for every published article.
• session _cfuvid The _cfuvid cookie is only set when a site uses this option in a Rate Limiting Rule, and is only used to allow the Cloudflare WAF to distinguish individual users who share the same IP address.
• It must indicate, where applicable, the member states where the product is known to have been made available.
• For a severe incident, the warning must also say whether unlawful or malicious acts are suspected.

Details worth keeping

Make CryptoSlate preferred on Share Share Commercial manufacturers whose connected hardware wallets or wallet software meet the European Union's product test must now warn cyber authorities within 24 hours of discovering an actively exploited vulnerability or severe security incident. 11, 2026, under the EU's Cyber Resilience Act, or CRA. A fuller notification is due within 72 hours unless the relevant information was already provided.

Related coverage

• Newsbtc: Read the latest update on EU Cyber Resilience Act Brings 24-Hour Vulnerability Reporting Into Force.
• Theregister: Manufacturers must now disclose actively exploited flaws and severe security incidents through ENISA's new reporting platform
• Cryptoslate: At block 1,371,000, v0.14.18.0 restores multi-input private spending and makes older software incompatible.
• Cointelegraph: Ledger and Trezor said researchers have a responsibility to publish their findings if vendors fail to fix bugs within an agreed disclosure window.