EU cyber rules mandate 24-hour bug reporting for crypto wallets

The European Union has mandated that cryptocurrency hardware and software wallet providers must report actively exploited bugs or severe security vulnerabilities within 24 hours of discovery. These new EU cyber rules are part of the Cyber Resilience Act (CRA), which became effective on Friday, as announced by the European Commission.

Manufacturers are required to submit an early warning for severe vulnerabilities within 24 hours, followed by a full notification within 72 hours. A final report is necessary 14 days after corrective or mitigating measures become available, or within one month for severe incidents. These reporting requirements are intended to enhance consumer and business protection against cyber threats and apply to all products with digital elements sold in the EU.

Non-compliance with these cybersecurity measures can result in significant administrative fines. Penalties may reach up to 15 million euros ($17.3 million) or 2.5% of a company's worldwide annual turnover, whichever is greater. Providing incorrect, incomplete, or misleading information can also lead to an administrative fine of up to 5 million euros.

These EU cyber rules were introduced following recent data breaches disclosed by hardware wallet providers. In September, Trezor reported that an additional 67,000 U.S. customers were affected by a data breach at its shipping provider, ShipMonk, exceeding initial estimates.

Trezor and BitBox also issued warnings to users about phishing emails potentially linked to compromised third-party email services. Earlier, in June, the Layer-1 blockchain network Zilliqa identified a vulnerability in its Ledger app that could allow attackers to recover private keys using public on-chain data.