Starting September 11, 2026, manufacturers of hardware and software crypto wallets must report actively exploited security vulnerabilities to EU regulators within 24 hours. The mandate is part of the Cyber Resilience Act (CRA).
The reporting process involves two stages. An initial warning must be filed via the ENISA platform within 24 hours of discovery. A detailed report covering the scope and technical specifics is required within 72 hours.
Failure to comply can result in fines reaching €15 million or 2.5% of annual global turnover, whichever is greater. Micro and small enterprises are exempt from penalties related to the 24-hour notification window.
The regulation applies to any company selling wallets in the EU, regardless of where the firm is headquartered. Manufacturers must also notify affected users about security issues and provide mitigation steps.
Broader CRA requirements, including security-by-design mandates and certification, take effect on December 11, 2027. This follows a July 2026 incident involving losses of over 1,778.84 BTC, valued at $112.7 million.
