The disclosure followed a similar event involving another leading wallet brand
Crypto wallet providers operating in the European Union must now submit an initial vulnerability report within 24 hours of discovering a security flaw, followed by a full notification shortly after. The requirement stems from the newly finalized European Cyber Resilience Act, which tightens cybersecurity obligations for digital product manufacturers. The rule applies to all hardware and software wallet makers offering services to EU users, regardless of where the company is based. The measure was introduced weeks after two major hardware wallet providers disclosed breaches that exposed user data, potentially enabling phishing or social engineering attacks. On September 4, Trezor revealed that an additional 67,000 U. S. customers had their email addresses compromised in a prior incident, though no private keys or funds were accessed.
Breaking news
Bitcoin Security Could Be Threatened by 2046, AI Model Indicates
XRP Ledger Patches Critical Bug That Could Have Minted 18 Trillion Tokens
Aptos Launches AI Tools to Simplify Move Programming
Regulatory Reach: CFTC Says It Can Oversight Nearly All CommoditiesThe disclosure followed a similar event involving another leading wallet brand, raising concerns about cumulative risks to user privacy and trust in self-custody solutions. How the 24-Hour Rule Changes Incident Response Under the Act, companies must act swiftly to assess and report vulnerabilities, reducing the window for exploitation. The initial report must include basic details about the flaw, affected products, and potential risks. A follow-up report within 72 hours is required to provide technical analysis, mitigation steps, and user guidance. Failure to comply could result in significant fines, up to 2.5% of global turnover or €10 million, whichever is higher. Regulators say the timeline aims to improve transparency and enable faster user protection. What Counts as a Reportable Vulnerability? Not every software bug triggers the reporting obligation.
The Act defines reportable vulnerabilities as those that could compromise the
The Act defines reportable vulnerabilities as those that could compromise the security of the device or service, particularly if they could lead to unauthorized access, data theft, or financial loss. For crypto wallets, this includes flaws that might expose recovery phrases, user identifiers, or transaction metadata. Companies must evaluate each issue using standardized severity scales before determining if it meets the threshold for disclosure. Frequently Asked Questions Does the 24-hour rule apply to all crypto wallet providers? Yes, any company offering crypto wallet services to users in the EU must comply, regardless of the company’s location. This includes both hardware and software wallet makers. What happens if a company misses the deadline? Failure to submit the initial report within 24 hours can lead to enforcement actions, including fines and mandatory corrective measures. Repeated violations may result in market restrictions. Are users notified directly under this rule?
While companies must inform users as part of their mitigation steps, the Act does not mandate a specific timeline for user alerts. However, timely reporting is expected to facilitate quicker communication.
