EU cyber rules put crypto wallet makers on 24-hour reporting clock
Crypto wallet providers must submit an early vulnerability report within 24 hours and a full notification within 72 hours of exploits, or risk administrative fines of as much as $17.3 million.
Asanat Analysis — Why it matters
The EU's Network and Information Security Directive (NIS2) now treats cryptocurrency wallet providers as critical infrastructure operators, subject to the same incident reporting timelines as banks and telecoms. The 24/72-hour window is deliberately tight—it prioritizes rapid disclosure over polish, reducing the window for attackers to exploit known vulnerabilities before users can react. The €17.3M fine ceiling (roughly 4% of annual revenue for large operators) signals enforcement intent beyond symbolic penalty.
This represents a structural shift in crypto's regulatory footing: wallets are no longer treated as software tools but as custodial infrastructure. Compliant providers now face operational friction (incident response protocols, documentation, audit trails) while non-compliant or unregistered players face exclusion from EU markets. The rule also creates asymmetric risk—centralized exchanges and custodians with existing compliance teams absorb costs easier than decentralized wallet projects, potentially consolidating custody concentration in regulated players.
Historically, crypto's innovation velocity relied on looser security disclosure norms. This deadline compresses incident response timelines from weeks to hours, raising the bar for wallet makers' engineering maturity while potentially accelerating security research publication. The ruling tests whether crypto's permissionless ethos can coexist with infrastructure-grade accountability.