In the European Union, providers of hardware and software crypto wallets are now required to report discovered vulnerabilities within 24 hours of detection. This requirement is enshrined in the EU Cyber Resilience Act, known as CRA; the new provisions began to apply on September 11.
How Vulnerability Reporting Will Be Organized
Companies are required to send the initial notification through the Single Reporting Platform (SRP), which is overseen by the EU Agency for Cybersecurity (ENISA). After submission, the data is sent to the computer incident response coordination group of the EU country relevant to the specific case.
The reporting does not end there. A full report on the vulnerability must be submitted within 72 hours from the moment it is identified. The final document must be prepared and sent within 14 days after the company releases a fix or takes other measures to reduce the risk. For serious incidents, a separate deadline is set: the final report must be submitted no later than one month later.
Who Will Be Affected by the New Rules
The European Commission expects that the updated requirements will strengthen user protection against cyber threats. The rules apply not only to crypto wallets: the CRA covers digital products that are sold or distributed in the EU.
This is a particularly sensitive topic for the crypto industry. A cryptocurrency wallet can come in different formats. Through it, the user gains access to assets and services.
- Hardware device.
- Mobile application.
- Computer program.
- Access to assets, including Bitcoin and Ethereum.
- Work with NFTs.
- Use of DeFi and Web3 applications.
Such solutions are based on blockchain, a public key cryptosystem, and software where authentication, authorization tokens, and correct transaction processing as an IT operation are important.
A broad crypto market infrastructure is built around wallets: large platforms and services, including Binance and Coinbase, operate alongside them. However, the new CRA obligations are primarily addressed to manufacturers of digital products and solution providers whose security determines user access to cryptocurrency.
Crypto Wallet in Simple Terms: Functions and Types
In simple terms, a crypto wallet is a tool that allows users to access their digital assets and confirm transactions with them. It is needed not only to store access to cryptocurrency, but also for transfers, working with NFTs, DeFi services, and Web3 applications.
- A hot wallet is connected to the internet and convenient for frequent transactions.
- A cold wallet stores access to assets without constant internet connection.
- A hardware wallet is a separate device.
- A software wallet works as an app on a smartphone or a program on a computer.
Cryptocurrency support depends on the specific wallet. Some solutions are designed for Bitcoin, others support Ethereum, NFTs, and various tokens for DeFi and Web3.
How to Choose a Crypto Wallet and Not Make a Mistake
There is no universal option for every case: for one task, simplicity is more important, for another — control over access and protection from attacks. Before choosing, it is worth checking several things.
- Which cryptocurrencies and tokens the wallet supports.
- Whether the format suits the task: mobile app, computer program, or hardware device.
- How clear the sending, receiving, and transaction confirmation processes are.
- How the wallet handles security updates.
- Whether there is convenient access to NFTs, DeFi, and Web3 applications.
If you need the simplest scenario, it is usually more convenient to start with a mobile app: it installs quickly and is suitable for small transactions. For long-term storage of a large sum, people often choose a cold or hardware wallet.
Rankings and top-10 lists help quickly make a short list, but it is better to choose a wallet not by its place in a selection, but by your needs: storage, frequent transfers, NFTs, DeFi, or Web3. There are various players on the market alongside wallets: Ledger is associated with hardware solutions, while Binance and Coinbase operate as major platforms and services around the crypto market.
How to Create, Fund, and Protect a Wallet
Creating a wallet usually starts with choosing a format. The user installs an app, program, or connects a hardware device, creates a new wallet, saves the seed phrase or another recovery method, sets a password, and checks security settings.
- To fund it, you can get the wallet address and transfer cryptocurrency to it from another platform or wallet.
- To withdraw, you can send assets to another wallet or to a platform where exchange is available.
- Restrictions may depend on the chosen service, network, fees, and the rules of a specific jurisdiction.
Users from Russia should check in advance whether the chosen app, manufacturer website, and funding and withdrawal methods are available in their specific situation.
A crypto exchange is a platform for buying, selling, and exchanging cryptocurrency. A wallet is primarily needed to access assets and manage transactions, while an exchange is for trading and exchanging. If assets remain on the platform, the user depends on its rules and security procedures.
The main risks for wallets are related to vulnerabilities, phishing, fake updates, and mistakes when sending transactions. To protect yourself, you should only download apps from official sources, store your seed phrase offline, check the recipient address, and not click on links from urgent update messages.
What Fines Threaten Companies
The Cyber Resilience Act provides for large penalties. For violating the security requirements set out in Articles 13 and 14, companies may face a fine of up to 15 million euros, or 17.3 million dollars, or 2.5% of global annual turnover.
Article 13 describes manufacturers’ obligations to maintain the cybersecurity of digital products throughout their entire lifecycle. Article 14 sets out the procedure and deadlines for reporting exploited vulnerabilities and serious incidents.
Fines will be collected at the national level under the laws of the specific EU country. The regulator responsible for CRA compliance in its jurisdiction will be able to choose the larger amount from the available options.
Separate liability is provided for inaccurate, incomplete, or misleading information submitted to supervisory authorities. In such cases, the administrative fine may reach 5 million euros, or 5.8 million dollars.
Why the Topic of Updates Has Become Especially Important
Previously, Ledger specialists warned about a new scam targeting owners of hardware crypto wallets. Attackers posed as the manufacturer’s support service and sent messages demanding an urgent installation of a supposedly critical security update.
Such attacks show why fast vulnerability notifications and clear response procedures are important for the market. Users have to carefully check any security messages, whether it is a notification inside an app, an email, or a message in messengers like Telegram.
