The 24-hour headline is the easy part. The Cyber Resilience Act changed what a wallet legally is.

The headline gets the date and the clock right and the duty wrong. On September 11, 2026, the reporting obligations under the EU Cyber Resilience Act became mandatory. The compressed version — "crypto wallets now have 24 hours to report a hack" — hides two things worth checking before you act on it. Twenty-four hours is only the first rung of a three-step clock, not the whole deadline. And the duty does not sit on the person holding the wallet. It sits on the person who made it.

Read the actual ladder, because the number you saw in the headline is the narrowest reading of a much larger obligation.

The ladder the headline flattened

The Cyber Resilience Act — formally Regulation (EU) 2024/2847 — requires any manufacturer of a covered product to file through a single EU-wide platform that feeds a national Computer Security Incident Response Team and ENISA, the EU's cybersecurity agency. The trigger is knowledge, not confirmation: a manufacturer becomes "aware" when it reaches a reasonable degree of certainty after an initial assessment, without waiting for every technical fact.

From that moment the clock runs in three stages:

• 24 hours — an early warning with preliminary information and whether malicious activity is suspected;
• 72 hours — a fuller notification with an initial assessment and mitigation steps;
• Final report — for an actively exploited vulnerability, within 14 days of a corrective measure being available; for a severe incident, within one month.

So "24 hours to report a hack" is real but incomplete. Twenty-four hours buys the maker less than a full incident report; it opens a file. The full account lands days later, and the actionable content — the patch-and-tell duty — can run for a month.

Get the scope right too, because it reaches further than the headline implies. The regulation covers any manufacturer placing a product with digital elements on the EU market, regardless of where that manufacturer is established. A wallet maker in California that sells into Europe is a "manufacturer" here and must designate an EU point of contact. Enforcement is explicitly cross-border. And a special category powers the stakes: violations of the vulnerability-handling and reporting chapters carry fines up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.

Set those two facts side by side and the casual reading dissolves: it is not "your wallet now files paperwork." It is "your wallet's maker now holds a binding, extraterritorial, money-weighted reporting obligation to a regulator it may never have dealt with."

The identity switch

This is the change that matters for anyone holding or evaluating a wallet business, and it is a change in legal identity, not in marketing. Lay the before and after out as two columns.

Before the effective date. A wallet is code you run. "Not your keys, not your coins" was more than a slogan; it was the legal reality — security is your problem, and the maker's exposure to you is a product-warranty question, not a regulator's file. A hack of a non-custodial wallet touches your keys; the manufacturer answers to civil law, if anyone, and to no EU agency on a deadline.

After the effective date. Insofar as the product is in scope, the maker is a manufacturer of a regulated product with a mandatory 24-hour early warning to a national CSIRT and ENISA the moment a covered vulnerability is actively exploited. The holder gained a reporting backstop; the maker gained a compliance floor with a fine ceiling.

The whole question — the one that decides what this actually costs — is who is in the "manufacturer" box.

Hardware wallets are the clean case. A physical device with digital elements, shipped in the EU, is squarely a product with digital elements; the entity that puts it on the market is a manufacturer. This is not ambiguous, and it is not new in kind — these firms already do security certification.

Monetized software wallets are in scope in the same way. A wallet distributed through an app store, earning fees or running a premium tier, is supplied in the course of a commercial activity, and software is a product with digital elements.

The open-source carve-out is where the honest boundary sits. Free and open-source software supplied for distribution or use — not monetized, not intended to profit — falls outside the core scope. But the test is "commercial activity," and it is brittle: the moment a wallet charges a price, or signals an intention to monetize, or takes donations that exceed its costs, it can cross into scope. A "community allocation" is not the same as a "no commercial activity" finding. The exemption protects the pure decentralized model and nothing richer.

And then there is the category that does not fit the law's own assumptions. The CRA was written for products that ship, get patched, and enjoy a defined support period. Smart-contract and fully on-chain custody code has no patch button by design. This is the genuine friction in the regime: an immutable product under a law built around updateability. How the Commission's implementation guidance — published this July, and explicitly non-binding — resolves that collision is the variable the whole crypto reading of this law turns on.

What it does to the money

Strip the drama and the economics are a compliance-cost story, and compliance cost in a wallet is a fixed cost spread over units.

The 24-hour reporting floor, the vulnerability-handling duty, the support-period obligation, and the conformity work that arrives with full applicability in December 2027 all raise the cost of serving EU retail. For a large, well-resourced wallet business — a hardware vendor with a certification budget, or an exchange's wallet unit inside an already-regulated stack — that is overhead to absorb and spread. For a small self-custody project, it is a floor that can price it out of the EU market or off the shelf. That asymmetry is a concentration tailwind: the regulation makes the regulated, resourced supplier relatively cheaper per user, and the marginal project relatively more expensive.

Two honest caveats keep the read calibrated. First, the direct US-listed exposure is thin — the big dedicated hardware names are private, and the listed players with wallets carry this as one more EU cost layer on top of MiCA rather than as a standalone catalyst. This is a structural, multi-year cost-and-moat story, not a single-stock jump. Second, the two boundary questions above — what counts as commercial activity for open-source wallets, and whether on-chain smart-contract wallets can even satisfy an updateability regime — remain unresolved. Non-binding guidance is not a statute, and the non-binding guidance is not final.

The break condition

Keep one fact on the desk. If the Commission's final guidance formally confirms that software-only, non-monetized, on-chain wallets sit outside "products with digital elements" — an exemption large enough to defuse the cost-and-moat reading for the decentralized segment — then the concentration thesis is premature, not wrong: the hardware and monetized-software part of the market is in scope either way.

Until then, the chain is checkable and stable. The date is September 11, 2026, the reporting duty is live, the ladder runs 24 hours to 72 hours to a month, the fines reach €15 million or 2.5% of worldwide turnover, and it binds any maker selling a covered product into the EU from anywhere on Earth. The headline told you the number. The statute told you who owes the hour. Read the second column before you decide what the first one means for a wallet you hold — or for a wallet company you're watching.