Kentucky lawmakers have advanced a consumer protection bill, HB 380, which includes a controversial amendment that critics argue would force hardware wallet manufacturers to build a backdoor into their products, effectively undermining the principle of self-custody. The bill, which passed the Kentucky House 85-0 on March 13, 2026, primarily targets cryptocurrency kiosks with provisions like a $2,000 daily transaction cap, a $10,500 limit on new-user accounts, a 72-hour cancellation window, fee caps, mandatory scam warnings, and defined refund rights for fraud victims.
The core controversy stems from House Floor Amendment 3, filed on March 12. Section 33 of this amendment requires any "hardware wallet provider" to supply live customer service and "provide a mechanism for, and assistance with, resetting any password, PIN, seed phrase, or other similar information" needed to access the wallet. Violations would be treated as unfair and deceptive trade practices under Kentucky law.
This directly contradicts Kentucky's own HB 701, signed into law in March 2025, which defined a hardware wallet as a device that stores private keys offline and allows the owner to retain independent control. HB 701 explicitly stated that an individual shall not be prohibited from using such a wallet. The Bitcoin Policy Institute, in a March 20 letter to the Senate, warned that complying with Section 33 would mean either storing seed phrases server-side or implementing a remote reconstruction path, creating a "cryptographic backdoor."
The FBI's 2024 Internet Crime Complaint Center report documented the scale of the kiosk problem, with 10,956 complaints tied to crypto kiosks resulting in $246.7 million in losses—a 31% rise from 2023. Victims over 60 accounted for roughly $107.2 million of that total, providing context for the legislative push for consumer protections.
The practical implications are severe for manufacturers. Pure non-custodial vendors like Trezor, whose design deliberately places full recovery responsibility on the user, would face legal exposure unless they fundamentally redesign their products. Vendors like Ledger, which offers an optional paid recovery service (Ledger Recover), are closer to compliance. The mandate would unevenly burden the industry, effectively putting a "regulatory thumb on the product market" by rewarding recoverable architecture and penalizing pure self-custody design.
HB 380 reached the Senate on March 16. The Kentucky legislative session runs through March 27, with a concurrence window from March 31 to April 1 before the veto period closes and the legislature adjourns on April 15. The Senate has a narrowing window to act. If it passes HB 380 with Section 33 intact, potential outcomes include manufacturers absorbing the legal risk, pulling out of the Kentucky market, or restricting sales to residents—all of which would degrade self-custody options for Kentuckians.
The resolution lies with the Senate. A targeted amendment to strip Section 33 or narrow its language to exclude devices defined in HB 701 would preserve the anti-fraud kiosk framework without reversing the state's commitment to wallet sovereignty. This path would also align Kentucky with federal guidance, such as the Office of the Comptroller of the Currency's March 2 stablecoin custody proposal, which excluded entities merely providing self-custody tools from custody requirements.
