EU Tightens Rules for Cryptocurrency Wallet Manufacturers

In the European Union, providers of hardware and software cryptocurrency wallets must now report any vulnerabilities found within 24 hours of their discovery. This requirement is enshrined in the EU Cyber Resilience Act (CRA), with the new provisions coming into effect on September 11.

How Vulnerability Reporting Will Work

Companies are required to send initial notifications through the Single Reporting Platform (SRP), overseen by the EU Agency for Cybersecurity (ENISA). After submission, the data is forwarded to the coordinating incident response group of the EU country relevant to the specific case.

But the reporting does not end there. A full vulnerability report must be submitted within 72 hours of its detection. The final document must be prepared and sent within 14 days after the company releases a fix or takes other measures to mitigate the risk. For serious incidents, a separate deadline is set: the final report must be submitted no later than one month after the incident.

Who Will Be Affected by the New Rules

The European Commission expects that the updated requirements will enhance user protection against cyber threats. The regulations apply not only to cryptocurrency wallets but also to digital products sold or distributed within the EU.

This is a particularly sensitive issue for the crypto industry. A cryptocurrency wallet can come in various formats, providing users access to assets and services.

• Hardware device.
• Mobile application.
• Computer program.
• Access to assets, including Bitcoin and Ethereum.
• Working with NFTs.
• Using DeFi and Web3 applications.

These solutions are based on blockchain technology, an open-key cryptosystem, and software where authentication, authorization tokens, and proper transaction processing as operations in computing are crucial.

A broad infrastructure of the crypto market is built around wallets, with major platforms and services like Binance and Coinbase operating alongside them. However, the new CRA obligations are primarily directed at manufacturers of digital products and solution providers, whose security is essential for users' access to cryptocurrency.

Cryptocurrency Wallets in Simple Terms: Functions and Types

A cryptocurrency wallet, in simple terms, is a tool that allows users to access their digital assets and confirm transactions with them. It is needed not only for storing access to cryptocurrency but also for transfers, working with NFTs, DeFi services, and Web3 applications.

• A hot wallet is connected to the internet and is convenient for frequent transactions.
• A cold wallet stores access to assets without a constant internet connection.
• A hardware wallet is a separate device.
• A software wallet operates as an application on a smartphone or a program on a computer.

The support for cryptocurrencies depends on the specific wallet. Some solutions are designed for Bitcoin, while others support Ethereum, NFTs, and various tokens for DeFi and Web3.

How to Choose a Cryptocurrency Wallet Without Making a Mistake

There is no universal option for all cases: for one task, simplicity is more important, while for another, control over access and protection against attacks is crucial. Before making a choice, it is worth checking several things.

• Which cryptocurrencies and tokens the wallet supports.
• Whether the format suits the task: mobile application, computer program, or hardware device.
• How clearly the sending, receiving, and confirming transactions are structured.
• How the wallet handles security updates.
• Whether there is convenient access to NFTs, DeFi, and Web3 applications.

If you need the simplest scenario, it is usually more convenient to start with a mobile app: it installs faster and is suitable for small operations. For long-term storage of a large amount, people often look towards cold or hardware wallets.

Ratings and top-10 lists help quickly compile a short list, but it is better to choose a wallet not by its position in the selection but by tasks: storage, frequent transfers, NFTs, DeFi, or Web3. In the market, alongside wallets, various players are noticeable: Ledger is associated with hardware solutions, while Binance and Coinbase operate as large platforms and services around the crypto market.

How to Create, Fund, and Protect a Wallet

Creating a wallet usually starts with choosing a format. The user installs an app, program, or connects a hardware device, creates a new wallet, saves the seed phrase or another recovery method, sets a password, and checks security settings.

• To fund the wallet, you can obtain the wallet address and transfer cryptocurrency from another platform or wallet.
• To withdraw, you can send assets to another wallet or to a platform where exchange is available.
• Limitations may depend on the chosen service, network, fees, and rules of a specific jurisdiction.

For users from Russia, it is important to check in advance whether the chosen app, manufacturer’s website, funding, and withdrawal methods are available in a specific situation.

A cryptocurrency exchange is a platform for buying, selling, and exchanging cryptocurrency. A wallet is primarily needed for accessing assets and managing transactions, while an exchange is for trading and exchanging. If assets remain on the platform, the user is dependent on its rules and security procedures.

The main risks for wallets are related to vulnerabilities, phishing, fake updates, and errors when sending transactions. To protect yourself, it is advisable to download apps only from official sources, keep the seed phrase offline, verify the recipient's address, and avoid clicking links from messages about urgent updates.

What Penalties Companies Face

The Cyber Resilience Act provides for significant penalties. For violations of security requirements outlined in Articles 13 and 14, companies may face fines of up to €15 million, or $17.3 million, or 2.5% of global annual turnover.

Article 13 describes the obligations of manufacturers to maintain the cybersecurity of digital products throughout their lifecycle. Article 14 establishes the procedure and deadlines for notifying about exploited vulnerabilities and serious incidents.

Fines will be imposed at the national level according to the laws of the specific EU country. The regulator responsible for enforcing the CRA in its jurisdiction will be able to choose a larger amount from the options provided.

Separate liability is provided for false, incomplete, or misleading information submitted to supervisory authorities. In such cases, the administrative fine may reach €5 million, or $5.8 million.

Why the Topic of Updates Has Become Especially Important

Earlier, Ledger specialists warned about a new fraudulent scheme targeting owners of hardware crypto wallets. Fraudsters posed as the manufacturer’s support service and sent messages demanding urgent installation of a supposedly critical security update.

Such attacks demonstrate why quick notifications about vulnerabilities and clear response procedures are important for the market. Users have to carefully check any security messages, whether it is a notification within the app, an email, or a message in messengers like Telegram.