The EU Cyber Resilience Act Takes Effect; Crypto Wallet Providers Must Report Vulnerabilities Within 24 Hours

Huoxing Finance reports that the EU’s Cyber Resilience Act (CRA) officially took effect on September 11, requiring providers of crypto hardware and software wallets to submit an early warning report within 24 hours of discovering actively exploited vulnerabilities or serious security flaws, and a full notification within 72 hours. Manufacturers must also submit a final report within 14 days after implementing corrective or mitigating measures, with severe incidents requiring reporting within one month. The European Commission stated that the new reporting requirements aim to better protect consumers and businesses from cyber threats, applying to all “digital element products” sold on the EU market and building upon the EU’s broader cybersecurity strategy. Under the final draft’s penalty provisions, companies failing to comply with Articles 13 and 14 may face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; providing incorrect, incomplete, or misleading information may also incur fines of up to €5 million. Prior to this measure’s implementation, several hardware wallet manufacturers recently disclosed user data breaches. On September 4, Trezor revealed that a data breach affecting its logistics provider ShipMonk impacted approximately 67,000 U.S. customers—exceeding the initial estimate of 14,000. This week, Trezor and BitBox also warned users to be cautious of phishing emails disguised as urgent security notices. In June, the Layer-1 blockchain network Zilliqa warned that a vulnerability existed in its Ledger application, allowing attackers to potentially recover user private keys using publicly available on-chain data.