A last-minute floor amendment buried in Kentucky House Bill 380 — a bitcoin ATM regulation bill that passed the House 85-0 on March 13 — would require hardware wallet manufacturers to help users reset seed phrases, PINs, and passwords. Security experts say compliance is architecturally impossible without building a backdoor into every device, and that manufacturers would simply stop selling in Kentucky rather than compromise their security model.
The provision is a textbook example of what happens when state regulators try to govern technology they don't understand. HB 380's core purpose — licensing bitcoin ATM operators, capping transactions, and fighting fraud — is legitimate and overdue. But Section 33, added as a floor amendment by Rep. Tom Smith (R-86th District), reveals how badly state-level crypto regulation can go wrong when legislators conflate fundamentally different technologies. The people this bill is supposed to protect — Kentucky consumers — would lose access to one of the safest tools for holding bitcoin if the provision survives.
85-0
House vote on HB 380
$247M
Bitcoin ATM fraud losses nationwide (2024)
132
Kentucky fraud complaints tied to bitcoin kiosks
$40K
Average loss per senior victim in Kentucky
What Section 33 Actually Says
Section 33 mandates that hardware wallet providers "provide a mechanism for, and assist any person who owns a hardware wallet that was provided by the provider with, resetting any password, pin, seed phrase, or other similar information." The provision also requires live customer service availability from 8 a.m. to 10 p.m. and identity verification before any reset assistance.
The problem: non-custodial hardware wallets are designed so that the manufacturer never has access to a user's seed phrase. The seed phrase is generated on the device itself and exists only there and wherever the user physically records it. There is no server, no database, no cloud backup that the manufacturer can query. Asking Ledger or Trezor to reset your seed phrase is like asking a safe manufacturer to open a combination lock they never set.
"Requiring hardware wallet providers to recover or reset credentials would effectively force them to redesign their products in a way that undermines self-custody — or exit the market altogether."
— Joe Ciccolo, Founder and President of BitAML, to Decrypt
The Bitcoin Policy Institute called the mandate "technologically impossible for non-custodial wallets" and announced it is sending a formal letter to the Kentucky Senate urging removal of the provision before a floor vote.
Regulators Don't Understand What They're Regulating
This isn't the first time state legislators have mangled crypto regulation by treating fundamentally different technologies as interchangeable, and it won't be the last. But Section 33 is an unusually clear illustration of the problem.
A bitcoin ATM is a regulated financial kiosk operated by a licensed money transmitter. A hardware wallet is a personal security device that a consumer buys and controls independently. These two things have almost nothing in common other than both involving cryptocurrency. Lumping them into the same bill is like regulating car dealerships and house keys in the same statute because both involve things that unlock.
"This is likely far more indicative of a misunderstanding than a deliberate attempt at control. Policymakers often struggle with the concept of self-custody."
— Joe Ciccolo, BitAML, to Decrypt
The pattern repeats across states. Legislators see a consumer harm — bitcoin ATM fraud is real, documented, and growing — and reach for the broadest possible tool. The result is often regulation that fails to address the actual problem while creating new ones. Minnesota is considering banning bitcoin ATMs entirely, a move that would eliminate a legitimate financial access point for unbanked communities to address fraud that could be handled through licensing and transaction limits. Connecticut suspended Bitcoin Depot's license for overcharging customers — a precise, targeted enforcement action that actually worked. The contrast is instructive.
The core irony of Section 33 is that hardware wallets are the solution to the custodial risk problem, not a contributor to fraud. Nobody gets scammed at a bitcoin ATM because they own a Ledger. People get scammed because operators fail to implement adequate warnings, because fees are hidden through drip pricing, and because there are insufficient safeguards for vulnerable populations. Regulating the wrong thing isn't just ineffective — it actively harms the consumers legislators claim to be protecting.
A Bill at War With Itself — and With Existing Kentucky Law
Kentucky passed HB 701 in March 2025, which explicitly protects residents' right to self-custody of digital assets and independent control of private keys. Section 33 of HB 380 would effectively negate that protection by requiring hardware wallet providers to maintain a recovery mechanism — which, by definition, means the user is no longer the sole custodian of their keys.
The Bitcoin Policy Institute's Managing Director, Conner Brown, put it bluntly on X: "Kentucky is suddenly about to ban self-custody."
That may overstate the legislative intent, but it accurately describes the practical effect. If hardware wallet providers must be capable of resetting your seed phrase, then by definition they have access to your keys. Self-custody ceases to exist. Kentucky's legislature would be undoing with one hand what it built with the other — less than a year apart.
The Core Bill: Legitimate Bitcoin ATM Regulation
Stripped of the hardware wallet provision, HB 380 represents the kind of targeted, proportionate regulation that the bitcoin ATM industry actually needs. The bill:
Key provisions of HB 380 (excluding Section 33):
- Licensing: Requires bitcoin kiosk operators to obtain state licenses
- Transaction limits: Caps daily transactions at $2,000
- Identity verification: Mandates KYC procedures for kiosk users
- Disclosure requirements: Establishes fee and risk disclosure rules
- Refund rules: Creates a framework for consumer refunds
- Fraud detection: Requires operators to implement fraud prevention measures
These provisions respond to a real problem. Kentucky residents filed 132 fraud complaints tied to bitcoin kiosks, with total losses exceeding $1 million. Seniors aged 60 and older averaged $40,000 per victim. Nationally, bitcoin ATM fraud losses reached $247 million in 2024, a 31% increase from 2023 — a figure the U.S. Treasury flagged just yesterday in a fresh warning about rising losses.
The $2,000 daily transaction cap is meaningful. Massachusetts' investigation found that over 80% of customers who spent $10,000 or more at Bitcoin Depot kiosks were scam victims. Kentucky's proposed limit would sharply reduce the ceiling for the highest-risk transactions. States like California, Iowa, and Maine have adopted even stricter $1,000 caps.
The bill was introduced on January 14, cleared the Banking and Insurance Committee on March 4, and arrived in the Kentucky Senate on Monday, March 17, where it was referred to the Committee on Committees.
Part of a Broader — and Uneven — State Crackdown
Kentucky is not acting in isolation. Iowa, Massachusetts, Missouri, and Washington, D.C. have all filed lawsuits or issued investigative demands against major operators including Bitcoin Depot, CoinFlip, and Athena Bitcoin. The quality and precision of these efforts varies enormously. Some states, like Connecticut, have taken targeted enforcement actions against specific bad actors. Others are reaching for blunt instruments — transaction bans, blanket prohibitions — that would eliminate consumer access to bitcoin ATMs entirely.
The problem with the blunt-instrument approach is that it disproportionately harms the people who rely most on bitcoin ATMs: unbanked and underbanked communities, immigrants, and people without traditional banking relationships. When a state bans bitcoin ATMs or makes them impractical to operate, it doesn't eliminate demand — it pushes consumers toward peer-to-peer transactions, unregulated platforms, or worse. Good regulation distinguishes between the operators enabling fraud and the technology itself. Section 33 fails this test completely.
Readers can review enforcement records and trust scores for individual operators on our operators directory.
Federal Policy Leans the Other Way
Section 33 also risks putting Kentucky at odds with federal policy. Executive Order 14178, signed in January 2025, explicitly protects "the ability of individual citizens and private-sector entities alike to access and use for lawful purposes open public blockchain networks" and maintain self-custody. SEC Chair Paul Atkins has made similar statements supporting self-custody rights.
A state mandate requiring hardware wallet backdoors would directly conflict with the federal government's stated position — potentially creating a legal challenge even if the provision survives the Senate.
What This Means for Kentucky Bitcoin ATM Users
If HB 380 passes with the core provisions intact:
- Transaction limits: You'll be capped at $2,000 per day at any bitcoin kiosk in Kentucky
- Better disclosures: Operators will be required to clearly show fees before you confirm a transaction
- Fraud protections: Operators must implement fraud detection, potentially including warning screens and delayed transactions for high-risk patterns
- Refund rights: A new framework will govern when and how you can get money back
- If Section 33 survives: Hardware wallet manufacturers like Ledger and Trezor would likely stop shipping to Kentucky rather than build security backdoors, reducing your options for safe self-custody
The hardware wallet provision would hurt the very consumers the bill is designed to protect. Hardware wallets are the safest way for individuals to store bitcoin. Driving them out of Kentucky would push users toward custodial solutions — exchanges and apps that are far more vulnerable to hacks, bankruptcy, and mismanagement. If you're a Kentucky resident who uses or plans to buy a hardware wallet, contact your state senator. The provision can still be stripped before a floor vote. For more on protecting yourself when using bitcoin ATMs, see our consumer protection resources.
What This Means for Operators
The core licensing and transaction-limit provisions of HB 380 would impose real operational changes on any company running bitcoin kiosks in Kentucky. A $2,000 daily cap would eliminate high-value transactions entirely — the same transactions multiple state AGs have identified as overwhelmingly scam-related.
Operators who already comply with FinCEN's Bank Secrecy Act requirements and maintain robust KYC procedures should be positioned to adapt. Those who don't may need to exit Kentucky or face enforcement. The licensing requirement also means unlicensed operators — an ongoing problem nationally, as Nebraska's cease and desist against Bitstop illustrated — would face clear legal consequences.
The Section 33 controversy is a cautionary tale — and an opportunity. When legislators don't understand the technology, well-intentioned bills produce harmful outcomes. The bitcoin ATM industry has generally been reactive to regulation rather than proactive. Operators and industry groups who engage directly with state lawmakers — explaining how self-custody works, demonstrating what effective fraud prevention looks like, and drawing clear lines between bitcoin ATMs and unrelated technologies like hardware wallets — are far more likely to get workable rules than those who wait for bad legislation to land on the governor's desk.
What Happens Next
The Senate can strip Section 33 before a floor vote — and based on the backlash from the Bitcoin Policy Institute, BitAML, and the broader bitcoin community, there is significant pressure to do so. The underlying bill has strong bipartisan support and addresses a documented consumer harm. The hardware wallet provision is the only real obstacle.
Kentucky HB 380 is a microcosm of the entire state-level bitcoin ATM regulatory landscape: real problems, real victims, and legislators reaching for solutions they don't fully understand. The fraud is real. The need for licensing and transaction limits is real. But so is the damage caused by regulation that conflates a bitcoin kiosk with a hardware wallet, or that treats the elimination of consumer choice as consumer protection. The Senate's handling of Section 33 will signal whether Kentucky can be precise about the problem it's solving — or whether it will join the growing list of states where good intentions and bad technical understanding combine to make things worse for the people who can least afford it.
