Covered commercial crypto wallet manufacturers must submit an early warning within 24 hours of becoming aware that a vulnerability in their product is being actively exploited under the European Union’s Cyber Resilience Act. The requirement is a reporting obligation, not a mandate to repair the flaw within one day, and it applies only to wallets within the law’s commercial scope.

The measure forms part of the EU Cyber Resilience Act, formally Regulation (EU) 2024/2847. The regulation establishes cybersecurity requirements for products with digital elements that connect to devices or networks. The European Commission provides further information in its Cyber Resilience Act reporting guidance and CRA summary.

For crypto wallet manufacturers, the most immediate change is the short reporting clock, which begins when the manufacturer becomes aware that an attack is underway.

What starts the 24-hour reporting clock?

The clock starts when a manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting its product. The manufacturer then has 24 hours to submit an early warning.

The trigger is narrow. It concerns vulnerabilities that attackers are actually exploiting, rather than every defect identified during routine development or testing. Legal experts at Freshfields have explained that active exploitation requires reliable evidence that a malicious actor is exploiting the vulnerability without the system owner’s permission.

The 24-hour period is therefore a duty to alert regulators, not a requirement to have a patch ready. A wallet manufacturer can report an ongoing attack while it continues investigating the incident and developing a corrective measure.

The early warning is only the first reporting stage. A full notification must be submitted within 72 hours of awareness, separately from the initial 24-hour warning.

For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective measure becomes available. For a severe incident, the final report is due within one month of the 72-hour notification.

These reporting duties began on 11 September 2026. The broader set of Cyber Resilience Act obligations will apply from 11 December 2027. The regulation entered into force on 10 December 2024.

Which crypto wallet makers are covered?

The rule applies to products with digital elements made available on the EU market. This includes products whose intended or reasonably foreseeable use involves a data connection to a device or network, a description that covers most crypto wallet software and hardware.

The term “commercial” is significant. Making a product available on the market means supplying it in the course of a commercial activity, whether the product is paid or provided free of charge. Software distributed at no cost can still fall within the scope if it is supplied as part of a commercial activity.

Products that are not supplied through a commercial activity are outside this particular scope. The application of the rule to any individual wallet remains a case-by-case question. Commission materials do not classify specific wallet products, and no cited source confirms whether a named hardware wallet, software wallet, or hosted service is covered or exempt.

Open-source projects are treated separately. Open-source software stewards will become subject to their own reporting obligations under Article 24(3) from 11 December 2027. Those stewards are not subject to Cyber Resilience Act infringement penalties.

The regulation also provides a size-based qualification. According to the Commission summary, manufacturers that qualify as microenterprises or small enterprises may not be fined for missing the 24-hour deadline. That does not remove their obligation to report.

The rule also applies to products that were already placed on the EU market before 11 December 2027.

Operational impact for wallet manufacturers

A 24-hour deadline leaves little time for a company to create an incident-response process after an attack has begun. Freshfields analysts have noted that the short reporting periods provide limited opportunity to establish procedures after an event occurs.

The deadline continues to run through weekends and public holidays. Freshfields has explained that those days do not pause the reporting period.

As a result, wallet teams may need to establish procedures in advance for recording the precise moment when awareness arises, escalating the matter to a responsible team, and compiling the required incident information quickly.

Regulatory reporting, incident investigation, and remediation are separate tasks. A manufacturer can notify regulators while continuing to determine the scope of the attack and develop or deploy a fix. The reporting process does not itself establish a deadline for completing remediation within 24 hours.

Manufacturers submit reports through the Cyber Resilience Act Single Reporting Platform. The report is addressed to the relevant national computer security incident response team, or CSIRT, and the information is made available to the European Union Agency for Cybersecurity, or ENISA, at the same time except in particularly exceptional circumstances.

For wallet users, submitting a report does not guarantee that a wallet is secure or that user funds are protected. It gives authorities early notice of an active attack. Required report fields, submission procedures, and any customer-notification obligations should be checked against official guidance before being treated as final.

For a crypto holder using a wallet from a company operating in the EU, the practical effect is that the manufacturer may now have to notify regulators rapidly when attackers exploit a product vulnerability. That reporting layer has applied since 11 September 2026.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always conduct your own research before making decisions.