EU CYBER RULES PUT CRYPTO WALLET MAKERS ON 24-HOUR REPORTING CLOCK

Summary from the TLDR Crypto newsletter

The EU's Cyber Resilience Act took effect on September 12, placing crypto wallet manufacturers on a tiered disclosure schedule: a 24-hour early warning for severe vulnerabilities, a 72-hour full notification, and a final report due 14 days after corrective measures are available. The regulation covers all hardware and software wallet products distributed in the EU, with penalties reaching €15 million or 2.5% of global annual turnover for violations of core reporting articles, and €5 million for inaccurate or incomplete disclosures. The effective date coincides with active security events: Trezor disclosed that 67,000 US customers faced exposure from a third-party shipping breach, and both Trezor and BitBox issued phishing warnings tied to compromised email services in September.