EU rule mandates 24h wallet breach alerts

TLDR

The European Unions Cyber Resilience Act now obliges many crypto wallet makers to warn authorities within 24 hours when a wallet vulnerability is actively exploited or a severe incident hits their product.

1. Commercial hardware and software wallet manufacturers serving the EU must file an early warning within 24 hours of discovering an actively exploited flaw or serious incident, with fuller reports due later.
2. The rule targets commercially supplied connected wallets on the EU market and focuses on regulatory reporting and user alerts, not fixing the bug within 24 hours or guaranteeing fund safety.
3. For users, this should mean faster public visibility of serious wallet breaches in the EU, but real protection still depends on timely updates, good security practices and how vendors implement the rules.

Deep Dive

1. What The 24 Hour Rule Requires

Under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), commercial manufacturers of connected hardware wallets and wallet software must report actively exploited vulnerabilities or severe security incidents to cyber authorities within 24 hours of becoming aware of them. This rapid report goes through ENISAs Single Reporting Platform, which distributes it to national CSIRTs and ENISA itself, according to a detailed CRA explainer on crypto wallets.

A more complete notification is required within 72 hours, followed by a final report either within 14 days after a fix becomes available for vulnerabilities or within one month after the 72 hour notice for severe incidents. A separate summary notes that these 24 hour reporting obligations started on 11 September 2026, while broader secure design duties under the same law will apply from 11 December 2027.

Manufacturers must also inform impacted users and, when necessary, all users about actions they should take, such as updating firmware or changing security settings.

2. Scope, Exemptions And Limits

The CRAs 24 hour rule covers commercially supplied connected products, which includes paid hardware wallets and downloadable wallet apps offered on the EU market, even when they are free but part of a commercial offering. Open source projects that are not monetized are generally outside this immediate reporting duty and instead face separate obligations starting in December 2027.

One advisory notes that wallet products not supplied commercially and some open source maintainers have Article 24(3) style duties later and without the same infringement penalties, which creates a practical gap between regulated commercial wallets and purely community projects. Micro and small enterprises may avoid fines for missing the 24 hour deadline but are still expected to report.

Crucially, the law mandates reporting, not instant remediation. The 24 hour clock starts when the manufacturer has reliable evidence that a vulnerability is being exploited by a malicious actor. Filing a report does not in itself secure user funds.

3. What Users And Providers Should Watch

For wallet providers, this rule effectively forces a more professional incident response setup. They need monitoring to detect actively exploited flaws, clear thresholds for when to trigger a 24 hour alert, and processes to push both regulatory reports and user notifications quickly. Vendors that already publish timely security advisories will likely adapt faster.

For users, the main change is transparency. Serious incidents affecting EU covered wallets should surface more quickly in official channels and in news coverage that references the new 24 hour reporting rule. The CRA was framed in part against a backdrop of real wallet breaches, such as prior incidents involving hardware and mobile wallets, to justify quicker disclosure.

Confidence: high, based on consistent descriptions of the Cyber Resilience Act in recent EU focused explainers.

Conclusion

The EUs 24 hour wallet breach reporting mandate is a regulatory transparency tool rather than a direct safety guarantee. It increases pressure on commercial wallet makers in the EU to detect and disclose real world attacks quickly, which should improve situational awareness for both regulators and users. The practical protection for crypto holders will come from how thoroughly vendors implement these obligations and how consistently users act on the resulting security notifications.