The European Union has implemented the Cyber Resilience Act, which became effective on September 11. The regulation mandates that developers of hardware and software crypto wallets registered in the EU must report security vulnerabilities within 24 hours of discovery.
Under the new rules, companies are required to submit a full statement within 72 hours of identifying an issue. A final incident report must be filed no later than 14 days after the fix is implemented, while reports on major incidents are due within a month of the initial 72-hour notification.
Reports must be submitted via the Single Reporting platform managed by ENISA. The information is then forwarded to CSIRT teams across EU member states. Manufacturers are also obligated to notify all affected or potentially vulnerable users about the security risks.
The regulatory shift follows several high-profile security incidents. In July, hackers exploited a firmware vulnerability in Coldcard wallets, resulting in the theft of at least 1778.84 BTC, valued at approximately $112.7 million, with total estimated losses reaching $153 million.
Wallet providers have faced multiple security challenges recently. Trezor reported a data breach affecting nearly 14 000 clients, while SafePal disclosed that the personal information of approximately 39 800 users was compromised. Other projects, including BitBox and Ledger, have also addressed various vulnerabilities.
