EU sets 24-hour clock for wallets

TLDR

The European Union has activated cyber rules that force crypto wallet providers to report serious security flaws within 24 hours.

1. Under the Cyber Resilience Act, commercial hardware and software wallets in the EU must file an early vulnerability report within 24 hours, then detailed follow-ups on tight timelines.
2. The obligations fall on manufacturers and distributors, raising compliance and security expectations but not directly changing how individual users hold or move coins.
3. Through late 2026 and 2027, technical standards, CE marks, and clarifications on which wallets are covered will determine which providers can keep serving EU users.

Deep Dive

1. What The New Rule Actually Does

The EUs Cyber Resilience Act (CRA) now requires crypto hardware and software wallet makers to notify European cybersecurity authorities within 24 hours of becoming aware of actively exploited bugs or severe vulnerabilities in their products. An early warning must arrive inside that 24-hour window, followed by a full notification within 72 hours and a final report after fixes are in place, typically 14 days after mitigation and within one month for severe incidents, according to a CRA enforcement overview for connected wallets in the EU.

The framework applies to products with digital elements offered in the EU, which captures commercially sold hardware wallets and many downloadable wallet apps. Reporting goes through ENISAs Single Reporting Platform, which then routes information to national incident response teams. Companies that fail to meet the reporting rules face significant fines, up to 15 million euros or 2.5% of global annual turnover, with additional penalties for incomplete or misleading submissions, as detailed in the European Commissions cyber rules for wallet makers.

2. Impact On Wallet Providers And Users

For wallet providers, this is primarily a security governance and compliance change. They must build internal processes to detect exploits quickly, assess severity, and file structured reports within tight deadlines, which increases operational cost and scrutiny. Open-source projects are not automatically exempt; commercially distributed open-source wallets can still trigger manufacturer obligations, with specific open-source reporting duties phased in from December 2027.

For everyday crypto users, the rule does not impose a 24-hour hold on their transactions or balances. Instead, it pushes vendors to disclose serious flaws faster and coordinate fixes with regulators, which should reduce the risk of silent vulnerabilities lingering in widely used wallets. Users are likely to see more security advisories and version updates, rather than direct changes to how they send or receive assets.

3. What To Watch Next

The CRA is broader than just reporting. Secure-by-design requirements, lifecycle obligations, and CE marking for covered products are scheduled to become mandatory in December 2027, with technical standards arriving in late 2026. That later phase will shape how wallets are designed, tested, and labeled across the EU market.

Regulators have not yet published a definitive list of which wallet brands and models are covered, and there is still nuance around cloud-connected, mobile, and purely local software. How they draw those lines will affect whether smaller, niche wallet providers can afford to remain in the EU, or shift to non-EU distribution.

For the wider crypto ecosystem, this is part of a trend toward stricter security reporting across digital products, which could influence how exchanges, bridges, and other apps handle vulnerabilities even outside the narrow wallet scope.

Conclusion

The EUs new 24-hour clock is about rapid vulnerability reporting by wallet providers, not freezing user funds. It raises the bar on how quickly serious flaws must be disclosed and addressed, with substantial fines for non-compliance. Over the next year or two, the combination of reporting rules, secure-by-design standards, and CE marking will determine which wallet projects can operate comfortably in the EU and may quietly push the market toward better-engineered, more transparent crypto custody tools.