Crypto wallet developers in Europe are now required to report vulnerabilities in their software within 24 hours of discovery. This requirement is part of the updated Cyber Resilience Act.
The rules came into effect on September 11. They apply to providers of hardware and software crypto wallets registered in the EU.
According to the document, early notification of a vulnerability or serious security incident must be sent within 24 hours of the manufacturer becoming aware of the issue. A full statement must be published within 72 hours.
A final incident report must be submitted no later than 14 days after patches are implemented. For serious incidents—within a month of the 72-hour notification.
Manufacturers are also required to inform all affected or potentially vulnerable users.
Reports are submitted via the Single Reporting platform created by ENISA. Notifications are sent to CSIRT: the organization must promptly forward them to relevant teams in other EU countries where the product is available.
Background
Concerns about the security of this segment escalated after the incident involving the hacking of Coldcard hardware wallets. In July, hackers began exploiting a seed phrase generation flaw that had been present in the firmware for several years.
By mid-August, Galaxy Research confirmed the theft of at least 1,778.84 BTC, worth $112.7 million. Including unconfirmed cases, the damage was estimated at approximately $153 million.
Sleep at Night Technology: How Coldcard Turned Its Users' Dreams Into a Nightmare
Concurrently, Bitcoin Red Team launched a large-scale AI scan of Bitcoin projects. The team checked hundreds of repositories and reported thousands of potential issues.
Wallet manufacturers are also facing other threats. On August 13, Trezor reported a data leak affecting nearly 14,000 customers via a logistics partner. On September 9, malicious actors sent users of the project a fake vulnerability warning after hacking a third-party mailing service.
Customers of BitBox faced a similar phishing attack.
On August 16, SafePal disclosed the theft of data from approximately 39,800 customers. Delivery addresses, phone numbers, and email addresses were leaked, which could be used for phishing and targeted attacks.
As a reminder, the OneKey Anzen team managed to replicate, under test conditions, a transaction substitution attack in the Ethereum app of the Ledger wallet version 1.22.1. Developers have already patched the vulnerability.
BitBox Fixed Two Critical Vulnerabilities in Bitcoin Wallet Firmware
