EU 24-Hour Exploit Reporting Deadline for Crypto Wallet Makers

Bitcoin's ethos of open, permissionless software now brushes against a hard EU compliance clock: under the bloc's Cyber Resilience Act, covered manufacturers of digital products face an EU crypto wallet exploit reporting deadline requiring an early warning within 24 hours of learning that a vulnerability is being actively exploited. The rule reportedly reaches crypto wallet makers, but its precise scope over Bitcoin wallet developers depends on operator role rather than the headline alone. The obligation flows from Regulation (EU) 2024/2847, the Cyber Resilience Act, a horizontal product-cybersecurity framework rather than a crypto-specific statute. Manufacturer reporting duties apply from 11 September 2026, according to the European Commission's reporting page. For related coverage, see Strive Bitcoin Holdings Hit 25,000 BTC After $36.6M Buy. What the EU's Reported 24-Hour Exploit Reporting Deadline Means The 24-hour stage is an early warning, not a fix-it deadline. Covered manufacturers must alert authorities within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident impacting the security of a product with digital elements. For related coverage, see KULR Sells Its Remaining 764 Bitcoin. CRA early-warning deadline 24 hours From 11 September 2026, covered manufacturers must issue an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident impacting product security. This is a reporting deadline, not a remediation deadline.Source: European Commission · Cyber Resilience Act reporting obligationsA fuller notification follows within 72 hours of awareness. Both the 24-hour and 72-hour clocks run from the moment the manufacturer becomes aware, not from the moment the flaw is patched. CRA full-notification deadline 72 hours Covered manufacturers must submit a full notification within 72 hours of becoming aware of an actively exploited vulnerability or a severe incident impacting product security. Both the 24-hour and 72-hour deadlines run from awareness.Source: European Commission · Cyber Resilience Act reporting obligationsThe staged timeline then diverges by event type. For actively exploited vulnerabilities, a final report is due no later than 14 days after a corrective measure becomes available; for severe incidents, the final report is due within one month of the 72-hour notification. Manufacturers file once through the CRA Single Reporting Platform, which the Commission says became operational on 11 September 2026. The notification is addressed to the CSIRT where the manufacturer has its main establishment and is normally made available simultaneously to ENISA, the EU's cybersecurity agency. Which Crypto Wallet Makers Would Be Covered? The Commission's materials establish general product scope but do not explicitly name crypto wallets. A single aggregator tip framed the rule as covering all crypto wallet makers, but that blanket coverage is unconfirmed and should not be read as settled.