The EU Cyber Resilience Act comes into effect, requiring cryptocurrency wallet providers to report vulnerabilities within 24 hours

According to Cointelegraph, the European Union's Cyber Resilience Act (CRA) officially came into effect on September 11, requiring cryptocurrency hardware and software wallet providers to submit early warning reports within 24 hours upon discovering actively exploited vulnerabilities or serious security flaws, and to submit complete notifications within 72 hours. Manufacturers must also submit final reports within 14 days after taking corrective or mitigating measures, while serious incidents must be reported within one month.

The European Commission stated that the new reporting requirements aim to better protect consumers and businesses from cyber threats, applicable to all "products with digital elements" sold in the EU market, and are built upon the EU's broader cybersecurity strategy. According to the penalty provisions of the final draft, companies that fail to comply with Articles 13 and 14 may face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; providing incorrect, incomplete, or misleading information may also incur fines of up to €5 million.

Before the implementation of this measure, several hardware wallet manufacturers recently disclosed incidents of user data breaches. On September 4, Trezor revealed that a data breach involving its logistics provider ShipMonk affected approximately 67,000 U.S. customers, exceeding the initial estimate of 14,000; this week, Trezor and BitBox also warned users to be cautious of phishing emails disguised as urgent security notifications. In June, the Layer-1 blockchain network Zilliqa warned of vulnerabilities in its Ledger application, where attackers could exploit publicly available on-chain data to recover user private keys.