A last-minute amendment requiring hardware wallet providers to help reset user credentials, tucked into Kentucky’s sweeping crypto ATM bill, is facing mounting backlash, with experts saying it is a fundamental misunderstanding of how crypto infrastructure works.

Section 33 of House Bill 380, added as a last-minute floor amendment during House debate, would require hardware wallet providers to furnish customers with a mechanism to reset “any password, pin, seed phrase, or other similar information” needed to access a wallet. 

“BPI is sending a letter to the Kentucky Senate informing them of the harmfulness of this language,” the group wrote on X.

Hardware wallets are physical devices that store crypto private keys offline and ensure only the user, not even the manufacturer, can access or recover them.

“This is likely far more indicative of a misunderstanding than a deliberate attempt at control,” Joe Ciccolo, Founder and President of BitAML, told Decrypt. 

“Policymakers often struggle with the concept of self-custody,” Ciccolo said, noting that “there is no central authority capable of resetting access credentials,” unlike traditional systems where recovery is standard.

BPI described the mandate as “technologically impossible for non-custodial wallets,” noting that requiring a backdoor undermines Bitcoin‘s fundamental security model and pushes users toward centralized custodians that are more vulnerable to hacks and failures.

“Kentucky is suddenly about to ban self-custody. Tell your friends,” Conner Brown, Managing Director at BPI, wrote on X.

“Requiring hardware wallet providers to recover or reset credentials would effectively force them to redesign their products in a way that undermines self-custody—or exit the market altogether,” Ciccolo said. 

“Most non-custodial wallet providers would likely choose not to operate in Kentucky rather than compromise their core security model,” he added, warning of “reduced consumer choice” and “diminished privacy protections.”

“The very consumers the bill aims to protect would lose access to one of the safest ways to store digital assets,” he said.

On safer paths forward, Ciccolo noted “social recovery mechanisms or multi-signature setups” can reduce risk “without introducing centralized control,” adding that “the best protection is ensuring users understand both the benefits and responsibilities of self-custody.” 

He also backed BPI’s move, saying “education is critical,” and that when proposals stem from a “knowledge gap,” direct engagement with policymakers is “the most effective path forward,” noting it “directly impacts consumers who value financial autonomy and security.”

HB 380 was introduced in the House on January 14, reported favorably out of the Banking and Insurance Committee on March 4, and passed the full chamber 85-0 on March 13. 

The underlying bill regulates virtual currency kiosk operators, establishes licensing requirements, and sets transaction limits, disclosures, and refund rules, provisions that carry broad political support and are expected to move the bill quickly through the upper chamber.

The bill arrived in the Senate on Monday and was referred to the Committee on Committees. 

Kentucky’s move follows a broader crackdown on crypto kiosks, with Connecticut halting Bitcoin Depot for compliance failures and Minnesota considering a ban on crypto ATMs.