Crypto wallet manufacturers selling hardware or software products in the European Union are now subject to incident-reporting requirements under the Cyber Resilience Act (CRA). Companies must send an early warning within 24 hours after learning of an actively exploited vulnerability or serious security issue, followed by a formal report within 72 hours. A final report is due within 14 days after a fix or mitigation is deployed, while serious security incidents require a final report within one month. Noncompliance with Articles 13 and 14 can draw fines of up to €15 million ($17.3 million) or 2.5% of global annual revenue, whichever is higher, and inaccurate or incomplete submissions can incur penalties of up to €5 million. The rules took effect September 11, 2026, ahead of broader CRA security-by-design and certification obligations scheduled for December 11, 2027. The enforcement follows recent wallet-related security concerns, including Trezor's disclosure that a ShipMonk data breach exposed 67,000 U.S. customers to added risk, phishing warnings from Trezor and BitBox, and Zilliqa's warning that a Ledger application flaw could expose private keys.