What Happened
On March 23, 2026, amendments to Hong Kong's national security enforcement rules took effect. The changes expand law enforcement authority in three areas relevant to anyone carrying digital assets: compelled decryption, password disclosure, and device seizure. Under the amended rules, individuals subject to a national security investigation can be legally required to unlock their electronic devices, provide passwords or decryption keys, and actively assist investigators with accessing encrypted data. Refusal is treated as obstruction, not as an exercise of privacy rights, and carries criminal penalties including fines and potential imprisonment.
The legislation does not enumerate specific device types. It refers broadly to electronic equipment, which legal analysts reviewing the text interpret as covering phones, laptops, external storage drives, and hardware cryptocurrency wallets. That last category is particularly relevant for self-custody Bitcoin holders. A hardware wallet is an encrypted electronic device whose entire purpose is to secure access to financial assets through cryptographic protection. That function makes it exactly the kind of device compelled decryption provisions are designed to reach.
The amendments also expand seizure authority. Law enforcement can now seize and retain electronic devices for the duration of an investigation. For a Bitcoin holder, device seizure creates immediate practical problems: access to funds is suspended until the device is returned or recovered through a separate seed phrase restoration process. If you are detained while traveling and your backup materials are at home, you may be unable to access your Bitcoin at all until the situation resolves.
Why Transit Passengers Are Exposed
Hong Kong International Airport is one of the highest-traffic transit hubs in the world, connecting routes between Asia, Europe, North America, and the Middle East. Travelers who do not formally enter Hong Kong territory, remaining airside between connecting flights, have historically operated in an ambiguous legal zone regarding local enforcement jurisdiction. Legal analysts reviewing the March 2026 amendments note that the national security investigation trigger does not require formal territory entry. There is no clear airside exemption in the text. The practical enforcement reality for transit passengers is not yet established through case precedent, but the legal exposure is real.
This is not a Hong Kong-specific problem. The UK compels decryption under the Investigatory Powers Act 2016. Australia has compelled access powers under the Assistance and Access Act 2018. US courts have produced inconsistent rulings on the Fifth Amendment limits of compelled decryption, with some circuits allowing it. What changed on March 23 is that a major transit jurisdiction with demonstrated willingness to use national security authority aggressively has now formalized these powers with explicit criminal penalties for refusal.
What This Means for You
If you travel internationally with a hardware wallet carrying a meaningful portion of your stack, Hong Kong should now be on your routing review list. The simplest posture adjustment is avoiding Hong Kong transit for routes where alternatives exist. If your itinerary requires it, the question is not whether your wallet is secure against a remote attacker. It is whether you want to be in a jurisdiction where a law enforcement officer can legally demand you hand it over and unlock it.
A more durable approach: separate your travel posture from your primary storage posture. Leave your primary hardware wallet at home. Carry a dedicated travel wallet loaded only with what you need for the trip. If that device is seized or you are compelled to unlock it, the exposure is limited and contained. Your primary holdings, held in your secured home environment under a separate seed phrase, are untouched.
The deeper principle this makes visible is that self-custody security has a physical layer that cryptographic security cannot protect against. Your seed phrase and your hardware wallet exist in the physical world. They can be seized by people standing in front of you. The protection against that threat is not a stronger device. It is not traveling with your full stack, understanding which jurisdictions have compelled decryption laws, and having a recovery plan that does not depend on the original device.
What to Watch
Watch for the first enforcement actions under the new powers, which will establish whether transit passengers are actively targeted versus those formally entering territory. Watch for similar legislative updates in Singapore and the UAE, both of which have pending national security framework reviews. The broader trend of compelled decryption authority expanding into transit contexts is the pattern that matters, not any single jurisdiction acting alone.