EU enforces new rule requiring crypto wallet makers to report breaches within 24 hours

The European Union (EU) has enforced rules requiring manufacturers of connected hardware and software, including cryptocurrency wallets, to report within 24 hours if they discover an actively exploited vulnerability or a major security incident.

Cryptoslate and the European Commission said on Sept. 13, local time, that the Cyber Resilience Act (CRA) reporting obligation has applied since Sept. 11. It applies to manufacturers of "products with digital elements" supplied to the EU market. Commercial hardware wallets or downloadable wallet apps that exchange data directly or indirectly with networks or other devices may also fall under the rule depending on product structure and how they are supplied. Not all cryptocurrency wallet services are automatically included.

If a manufacturer becomes aware of an actively exploited vulnerability or a major incident affecting product security, it must submit an initial alert without delay and no later than 24 hours. It must then file a formal report within 72 hours including the nature of the vulnerability or incident, product information, and damage and mitigation measures.

The deadline for the final report varies by case. For an actively exploited vulnerability, it must be filed within 14 days after corrective or mitigation measures are prepared. For a major incident, a final report must be submitted within 1 month after the 72-hour formal report. Manufacturers must also inform affected users of the incident and necessary security measures.