Wallet makers no longer get to sit on bad news quietly. Under the new rules, qualifying commercial wallet hardware and software must flag serious security incidents through a three-stage reporting process, with the first alert due within 24 hours of exploitation. Faster disclosure should mean faster fixes, but it also puts real pressure on smaller teams to have incident response ready before something goes wrong, not after.