EU Imposes 24-Hour Exploit Disclosure Deadline on Crypto Wallet Makers

Crypto wallet manufacturers selling products in the European Union now have just 24 hours to alert authorities after discovering that a security flaw in their software or hardware is being actively exploited by attackers.

The clock started on September 11, when Article 14 of the EU's Cyber Resilience Act (CRA) became applicable. The provision covers any "product with digital elements" made available on the EU market, a category that legal experts say likely includes commercial hardware wallets and desktop or mobile wallet applications. The obligation applies to manufacturers regardless of where they are based.

Under the new rules, a company that becomes aware of an actively exploited vulnerability must file an early warning through the Single Reporting Platform operated by ENISA, the EU's cybersecurity agency, within 24 hours. A more detailed notification is due within 72 hours, followed by a final report within 14 days of a corrective measure becoming available. Severe security incidents follow the same initial deadlines, with the final report due one month after the first filing.

The reporting requirement is not triggered by a private bug report from a researcher. A manufacturer can receive a report, investigate it, and prepare a patch without automatically falling under the Article 14 deadline. The clock starts only once the company learns that attackers are exploiting the flaw before a fix is complete.