Commercial manufacturers of connected hardware wallets and wallet software covered by the European Union's Cyber Resilience Act must notify ENISA and designated cyber-response teams within 24 hours of discovering an actively exploited vulnerability or severe product-security incident. The reporting provisions took effect Sept. 11, 2026, ahead of the CRA's broader security-by-design, conformity-assessment and CE-marking requirements, which begin Dec. 11, 2027. Manufacturers must submit a fuller notification within 72 hours and a final report after corrective or mitigating action becomes available through ENISA's Single Reporting Platform. The new obligations come as Coldcard responds to attacks that drained Bitcoin from its devices and as Trezor reports a ShipMonk data breach affecting thousands of U.S. customers. Administrative fines do not apply to microenterprises and small enterprises that miss the 24-hour early-warning deadline, but the reporting duty remains.