EU Cyber Resilience Act Mandates 24-Hour Breach Reporting for Crypto Wallet Firms

Crypto wallet makers are now on the clock. The EU’s Cyber Resilience Act took effect last Friday, and it gives hardware and software wallet providers exactly 24 hours to flag a severe security vulnerability after they find it. No grace period. No wiggle room.

The law sets out a three-stage reporting ladder. First comes a preliminary notice within 24 hours of discovery. Then a full notification within 72 hours. And a final, detailed report lands 14 days after corrective actions are actually available to users. Companies that blow past those deadlines face fines up to €15 million — that’s roughly $17.3 million — or 2.5% of global annual turnover, whichever number is bigger. And if a company hands over incomplete or misleading information during the process, that’s a separate problem: additional penalties up to €5 million can stack on top. The European Commission has been contacted for further comment on how enforcement will work in practice. No response so far.

The timing is pretty pointed.

Trezor, BitBox, and a String of Recent Breaches

The Act’s rollout comes right after a rough stretch for hardware wallet companies. Trezor, one of the bigger names in the space, recently disclosed a data breach tied to its shipping partner ShipMonk. The final count of affected US customers came in at 67,000 — a jarring jump from the initial estimate of 14,000. Personal information was exposed. The breach didn’t stay quiet for long, and Trezor’s disclosure process drew scrutiny across the industry.

Both Trezor and BitBox then had to warn users about phishing emails. The emails were dressed up as urgent security notices, mimicking the kind of alert you’d actually want to click on. The suspected cause: compromised third-party email services. It’s a classic vector, and it worked well enough that both companies felt they needed to push out public warnings.

Earlier, the Zilliqa blockchain network flagged a separate issue — a vulnerability that could expose users’ private keys through public onchain data. Not a small thing. Private key exposure is basically the worst-case scenario in crypto security. Zilliqa warned users, but the incident added to a growing list of examples showing that the attack surface across wallets and blockchain infrastructure is wider than a lot of people want to admit.

What the EU Is Actually Trying to Do Here

The European Commission framed the Cyber Resilience Act as a consumer protection measure, not just a crypto-specific rule. The regulations cover all digital products sold or available within the EU — so the scope goes well beyond wallets. But crypto hardware and software products sit squarely in the crosshairs, given how much sensitive financial data they hold and how fast vulnerabilities can be weaponized once they’re known.

More context: Letitia James Leads 17 AGs to Block Crypto Clarity Act Vote in Senate

The logic behind the 24-hour window is speed. When a bug is actively being exploited, every hour matters. Regulators want to know fast, so they can coordinate responses and, presumably, push companies to patch faster than they might on their own timeline. Whether 24 hours is actually achievable for complex vulnerabilities — ones that might require deep forensic work before anyone even knows what they’re dealing with — is a fair question. Unclear how the Commission plans to handle edge cases where the nature of the flaw isn’t immediately obvious.

The fines are probably the sharpest tool here. €15 million or 2.5% of global turnover is real money for most wallet providers. It’s the kind of number that gets compliance teams hired and incident response procedures actually written down. For smaller firms, it’s potentially existential. For larger ones, it’s a strong incentive not to sit on a vulnerability while quietly trying to patch it without anyone noticing.

Crypto wallet security has been a pressure point for years. Hardware wallets were supposed to be the safe option — the offline, cold-storage answer to exchange hacks and hot wallet drains. But the ShipMonk breach at Trezor shows that even companies making physical security devices can get hit through third-party partners who handle shipping data. The attack surface isn’t just the device. It’s everyone the company does business with.

BitBox’s phishing situation makes the same point from a different angle. You can build a secure product and still have users targeted through the email infrastructure around it. Security isn’t a single layer. It’s the whole stack.

Read also: Senates CLARITY Act Faces Critical Vote After Intense Bipartisan Negotiations

Companies across the EU are now working out what these new requirements actually mean for their internal processes. Legal teams are reading the fine print. Security teams are figuring out what counts as “severe.” And the 14-day final report deadline is probably giving some engineering leads a headache, since patches don’t always ship on a clean timeline.

Trezor’s affected customer count: 67,000.