EU Mandates 24-Hour Breach Reporting for Crypto Wallet Makers

The European Commission announced that the Cyber Resilience Act took effect on Friday. Hardware and software wallet providers must now report severe vulnerabilities within 24 hours of awareness. A full notification is required within 72 hours. A final report must be submitted 14 days after corrective measures are available. For severe incidents, the final report is due within one month.

The regulation applies to all products with digital elements made available in the EU. The goal is to protect consumers and businesses from cyber threats. Companies face financial penalties for non-compliance. Fines can reach 15 million euros or 2.5% of worldwide annual turnover. Whichever amount is higher will be charged. Providing incorrect or misleading information carries a fine of up to 5 million euros.

Recent data breaches highlighted risks

These rules follow recent security incidents in the crypto sector. Trezor disclosed that 67,000 US customers were at risk due to a shipping provider breach. This figure exceeded the initial estimate of 14,000 users. Trezor and BitBox also warned users about phishing emails disguised as security notices. In June, Zilliqa warned about a vulnerability in the Ledger app. This flaw could allow attackers to recover private keys using on-chain data.

According to GN markets/crypto (en-US), the European Commission stated these measures build on the broader EU cybersecurity strategy. The timing coincides with heightened scrutiny of third-party service providers. Wallet makers are now under pressure to demonstrate rapid incident response capabilities. The 24-hour window leaves little time for internal assessment before external reporting. This shift changes the operational requirements for security teams in the industry.

Financial penalties for non-compliance

The penalty structure is designed to be punitive. The maximum fine of 15 million euros is substantial for smaller firms. The alternative of 2.5% of global turnover targets large multinational corporations. This dual approach ensures wide-ranging deterrence. Incorrect reporting is treated with equal severity. A fine of 5 million euros applies for incomplete or misleading data. These figures are drawn from the final draft of the Act.

Market participants must now integrate these deadlines into their compliance frameworks. The 72-hour full notification adds a layer of detailed disclosure. This follows the initial 24-hour warning. The 14-day final report requirement ensures closure of the incident loop. One month is allowed for the most severe cases. These timeframes create a rigid hierarchy of reporting obligations.

Scope extends to digital products

The Act covers all products with digital elements sold in the EU. This includes hardware wallets and software applications. The definition is broad to prevent regulatory arbitrage. Manufacturers cannot avoid these rules by selling only software versions. The focus is on the end user's exposure to risk. The European Commission aims to close gaps in current cybersecurity laws. This creates a unified standard for digital product security.

Industry leaders are reviewing their incident response plans. The 24-hour clock starts at the moment of awareness. This requires immediate detection and verification protocols. Delays in internal reporting can trigger violations. The financial stakes are high for all players. Compliance is no longer optional for market access. The EU is establishing a new baseline for digital trust.