The European Commission has officially mandated all crypto hardware and software wallet manufacturers to report exploited bugs or severe cyber vulnerabilities within 24 hours of detection. This rapid reporting rule is part of the Cyber Resilience Act (CRA), which now applies to all products with digital elements across the EU market. The policy follows a user data breach incident involving a prominent hardware wallet vendor in early September.
The new cybersecurity law establishes a tiered reporting timeline that leaves companies no room to delay announcing a security crisis.
24-Hour, 72-Hour, and 14-Day Reporting Schedule
Wallet makers now bear the obligation to submit an early warning to authorities within the first 24 hours of detecting a security vulnerability. Once the initial warning is sent, companies must submit a comprehensive incident notification within a 72-hour deadline.
The reporting chain continues until the system remediation phase is complete. Companies are required to submit a final report within 14 days after mitigation measures become available to users. For particularly severe cyber incidents, the maximum deadline for submitting the final report is set at one full month.
What Is the Cost of a Delay?
Companies that violate reporting obligations under Articles 13 and 14 of the CRA face administrative fines of up to 15 million euros, or roughly $17.3 million. Regulators also hold the option to set fines at 2.5% of the company’s total annual global turnover, directly cutting into the revenue of entities that delay reporting.
Separate sanctions are also in place for parties attempting to manipulate data during the reporting process. Providing false, incomplete, or misleading information to authorities carries the risk of an additional fine of up to 5 million euros.
For retail users, this rule ensures instant transparency whenever their digital wallets are compromised or breached. For wallet makers, covering up issues now carries the threat of legal sanctions that cost far more than the technical fixes themselves.
Source: Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
