EU Mandates 24-Hour Reporting of Cryptocurrency Wallet Vulnerabilities

As part of the updated Cyber Resilience Act, cryptocurrency wallet developers in the European Union must now report any software vulnerabilities within a strict 24-hour timeframe. This regulation, which came into effect on September 11, applies to both hardware and software wallet providers registered in the EU.

Under the new rules, manufacturers are required to notify authorities about any vulnerabilities or significant security incidents as soon as they are discovered, with a detailed report due within 72 hours. Additionally, final incident reports must be submitted within 14 days after any fixes are implemented, while serious incidents necessitate a report within a month following the initial notification.

Wallet manufacturers must also inform all affected users about any vulnerabilities that may impact them. Reports should be submitted through the Single Reporting platform established by the European Union Agency for Cybersecurity (ENISA), which will relay the information to the Computer Security Incident Response Team (CSIRT) and relevant teams in other EU nations where the products are sold.

Background Context

The necessity for these regulations has been underscored by recent security concerns in the cryptocurrency sector, notably following a hacking incident involving Coldcard hardware wallets. In July, hackers exploited a long-standing flaw in the seed phrase generation process, leading to significant losses. By mid-August, Galaxy Research confirmed that at least 1,778.84 BTC, worth approximately $112.7 million, had been stolen, with total damages possibly reaching $153 million when including unverified incidents.

Other wallet manufacturers have also faced challenges; for instance, Trezor reported a data breach affecting nearly 14,000 customers due to a logistics partner, while SafePal disclosed a breach impacting around 39,800 clients. These incidents highlight the growing need for improved security measures in the crypto wallet industry.