The D’CENT biometric wallet uses your fingerprint to unlock the device and approve transactions. It does not store, replace or back up your recovery phrase. Lose the device without those words written down and the fingerprint is worthless, because the fingerprint never leaves the chip it was registered on.
Listen to this article, about 14 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.
Recorded 10 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.
On this page: a detailed breakdown of D’CENT Biometric Wallet security, featuring Trustpilot review statistics, Coinspect audit discrepancies, a comparison table, and an essential firmware update checklist.
Think you already know this? Five questions, one minute.
Every answer is on this page. Answer from what you know now; the page fills in the rest.
-
1. Which D’CENT product was affected by the late 2026 security incident involving older versions?
According to the App Wallet incident report, the vulnerability affected users who entered their recovery phrase into the App Wallet on versions earlier than 8.1.0. Read the section
-
2. How is the fingerprint template stored on the D’CENT Biometric Wallet?
The template is encrypted and held inside the secure element, never leaving the chip, as described in the official post on biometric authentication. Read the section
-
3. What acts as the master key and only proof of ownership of your coins?
According to the D’CENT shop specification, the recovery phrase is the only proof of ownership of the coins and is required to restore accounts. Read the section
-
4. What secure element chip was described in the original 2020 audit write-up?
The 2020 audit by Coinspect evaluated a secure enclave chip that differs from the one sold today, as detailed in the audit post. Read the section
-
5. What is the primary biometric issue reported by D’CENT owners in public reviews?
Public feedback on D’CENT’s Trustpilot profile shows that the characteristic biometric failure is the reader refusing to recognize a fingerprint, leaving users to enter their passcode. Read the section
What has changed since this was first published?
One thing changed sharply, and it is not the device this article is about. It is the D’CENT phone app, and if you ever typed this wallet’s recovery phrase into it, read this section before anything else.
- As of September 2026, D’CENT’s own App Wallet incident report, first published as a preliminary report on 17 September 2026 after an alert on 16 September, says users are potentially affected if they entered a recovery phrase into the App Wallet and signed any transaction or approval with it on an app version earlier than 8.1.0, which was released on 5 November 2025. The vendor tells affected users to create a wallet with a new recovery phrase and move every asset to it, because reusing the old phrase may regenerate the same or a related key.
- The scale, reported by CryptoSlate: about 11.7 million XRP, close to $20 million, taken from 6,678 wallets in six waves between 15 and 20 September 2026. Blockhead, on 23 September 2026, reports D’CENT’s position that the Biometric hardware wallet is not affected unless its recovery phrase was also restored into the App Wallet, and that the company has withheld the technical details. Outside researchers suspect weak randomness in older app versions; that is their suspicion, not a published finding.
- The firmware has not moved. As of September 2026 the Biometric Wallet is still on v2.35.2 of 16 March 2026, the same build this article named on 9 September, per D’CENT’s firmware post. No hardware advisory was found on 27 September 2026.
- The Trustpilot profile read 108 reviews at 3.7 out of 5 on 27 September 2026, 58 percent five star and 30 percent one star, down from 102 reviews at 3.9 on 9 September. The newest one star reviews, dated 18 and 19 September 2026, describe unauthorised XRP withdrawals. They do not say which D’CENT product was involved, so they are recorded as what the reviewers reported.
The lesson is the one this article was already making, with a date on it now. The fingerprint did nothing either way, because none of this touched a fingerprint. The phrase, once typed into software, stopped being as safe as the paper it was written on. Security writing that treats a hardware wallet and its maker’s phone app as one product is how people end up importing the phrase in the first place; the ways that goes wrong are laid out in how hot wallets actually get drained. A month later the same lesson arrived at another Bluetooth wallet maker, when SecuX confirmed a hacked banner inside its phone app.
What does the fingerprint actually do?
It unlocks the device and it authorises a signature. That is the whole job. The sensor is a capacitive touch reader, and the D’CENT shop specification says you can register up to two fingerprints, or skip biometrics entirely and use a 4 to 8 digit PIN instead. The fact that the PIN is offered as a straight swap tells you exactly how much cryptographic weight the fingerprint is carrying, which is none.
D’CENT’s own post of 13 March 2026 on biometric authentication puts it plainly: the fingerprint template is encrypted and held inside the secure element, never in device memory, app databases or a server, and the recovery phrase remains the master key to the funds. That is the vendor saying the quiet part out loud on its own shop blog, which is more than most of the review sites ranking for this device manage to do.
Functionally it is the same slot a PIN occupies on a Trezor hardware wallet, or the passcode on a Ledger Nano S Plus. A convenience layer over the thing that matters. The affiliate reviews put the sensor in the headline because a fingerprint photographs well and a seed phrase does not.
If the fingerprint is not the backup, what is?
The recovery phrase, written on the Recovery Sheet that ships in the box. The shop page states that as long as you have that phrase you can restore your accounts on a new D’CENT Biometric Wallet, and that those words are the only proof of ownership of the coins. D’CENT does not hold a copy. Nobody can reissue it.
So the failure your fingerprint does not cover is the ordinary one. The device is lost, stolen, broken, or sent back under warranty. Your finger still works perfectly. It just has nothing left to press. Restoring means typing 24 words into a replacement device, and if those words are not written down somewhere you control, the coins are gone. That rule governs every non custodial wallet and does not soften because the unlock method got nicer.
Write the phrase on the sheet or on steel. Never type it into a website, a support chat, a browser extension or a phone app that offers to check or validate it. Any tool asking for a recovery phrase is taking the coins, without exception. If you are new to this, the mechanics are covered in more depth in what a cold wallet actually is.
What has been audited, and what is in the device today?
Every ranking page for this wallet repeats that it was independently audited by Coinspect. That is true. It is also older and narrower than the phrase suggests, and the gap is visible on D’CENT’s own website rather than anywhere exotic.
The audit post, published 2 March 2020, describes the hardware Coinspect looked at as a two chip design: an STM32 acting as the brain of the wallet, and an NXP chip housing the secure enclave where private keys are stored. No critical issues were found, some minor non security concerns were fixed, and Coinspect confirmed the fixes. That is a good result and it is worth having.
The problem is what the same shop says today. D’CENT’s firmware post of 2 April 2026 and its biometric post of 13 March 2026 both name the secure element as an ST33, an STMicroelectronics part, certified to EAL5+. NXP and STMicroelectronics are not the same company and an ST33 is not the chip described in the audit write up. Checked on 9 September 2026, no published Coinspect report covering the ST33 hardware or the current firmware could be found, and the old user guide URLs that reviews still link to now redirect to a bare support landing page.
| What the badge implies | What the vendor pages actually say |
|---|---|
| Independent audit of the device you can buy now | Audit write up published 2 March 2020, no dated report for current hardware found on 9 September 2026 |
| The audited secure element | An NXP chip housing the secure enclave, per the audit post |
| The secure element described in 2026 | An ST33 rated EAL5+, per the firmware post of 2 April 2026 and the biometric post of 13 March 2026 |
| Firmware covered | Not stated in the audit post. Current release is v2.35.2, issued 16 March 2026, change note “improved stability” |
| Source code review possible by anyone else | No. The firmware is closed source, which is the objection raised throughout the 2022 Bitcointalk thread below |
None of that means the device is unsafe. It means the word audited is doing work it has not been asked to do since 2020, and a reader deciding on the strength of that badge deserves the date attached to it. If you want the contrast, this site has written about a vendor whose problem was not the chip at all in the SafePal customer data leak.
What do people who own one actually report?
Reading the public record on 9 September 2026: 102 reviews on D’CENT’s Trustpilot profile, scoring 3.9 out of 5, split 60 percent five star and 28 percent one star, plus a 2022 owner discussion on Bitcointalk. The shape of the complaints is the interesting part, because it is not the shape the security debate expects.
A reviewer posting as Vegas Baby on 23 January 2026 rated it three stars and said the fingerprint reader simply would not work, leaving them entering the passcode instead. D’CENT replied suggesting re registering the print or running PIN only. That is the characteristic biometric failure in the record: refusal to read, not defeat by an attacker.
Several one star reports involve funds moving in ways the owner did not intend. Harcourt Ward, 22 November 2025, reported an unauthorised XRP transfer at 4:41am. Larry Quillopo, 23 April 2026, reported a wallet drained despite having secured the seed phrase. Both are single accounts with no independent confirmation, D’CENT replied to each directing them to support, and neither can be verified from outside. They are recorded here as what the reviewers reported, not as findings. Since September 2026 there is one documented route by which a phrase could be drained without the device ever being touched, the App Wallet flaw described at the top of this page, but neither review says whether the phrase had ever been typed into the app, so it would be guessing to connect them.
The larger group of loss reports is more mundane and better documented. On page two and page three, reviewers describe failed XRP transfers because the destination account was never activated (wjnsail, 20 February 2026), coins lost to unfamiliar gas fees (Terry LaRont, 13 January 2026), and a swap through a third party provider that ate the tokens (James Anthony, 31 March 2026). Thomas Strebeigh reported the wallet freezing during an update and support resolving it. Mark James, 24 April 2026, reported a warranty replacement handled under guarantee, which is precisely the case where the recovery phrase is the only road back to the coins.
Against the pattern: a majority of these reviewers are happy, and several single out the fingerprint as the reason they chose it. The 2022 Bitcointalk thread cuts the other way again, where experienced posters objected to the closed source firmware and to Bluetooth being in the threat model at all, an objection the 2026 product does nothing to answer.
Where the accounts agree with the official guidance: the recovery phrase is what saves people, and the biometric is convenience. Where they diverge: the vendor markets the sensor as the headline security feature, while the owners who lost money mostly lost it to transaction mistakes the sensor was never going to catch. Testimony, not evidence, and dated so you can check it.
How does a fingerprint compare with a PIN on other wallets?
| D’CENT fingerprint | PIN on a hardware wallet | Recovery phrase | |
|---|---|---|---|
| What it protects | Physical access to an unlocked device | Physical access to an unlocked device | The keys themselves |
| Where it lives | Encrypted inside the secure element, per D’CENT | On the device | Wherever you wrote it down |
| Can it restore a lost device | No | No | Yes |
| Can you change it | Re register, up to two prints | Yes | Only by moving to a new phrase |
| Failure mode owners report | Refuses to read your finger | Forgotten, device wipes after retries | Never written down, or written down where someone found it |
The row that decides everything is the third one. Two of these three things cannot bring your coins back, and the one that can is a piece of paper.
What is worth checking before a firmware update?
The current Biometric Wallet firmware is v2.35.2, released 16 March 2026, with a change note of improved stability, according to D’CENT’s firmware update post of 2 April 2026. Updates run either from a computer over USB using the D’CENT Bridge in Chrome, or from an Android phone over an OTG cable.
D’CENT states that a normal firmware update does not erase accounts, balances or settings, and still recommends confirming your recovery phrase is stored safely offline before you start. Follow that recommendation. Reviewers have reported the device freezing mid update, and the difference between an inconvenience and a loss in that moment is whether the phrase exists somewhere outside the device.
Confirm the version on the vendor pages rather than in a review, including this one. Firmware numbers move, and a page written six months ago is not evidence about the build on your desk.
Firmware Update Security Checklist
Before updating your D’CENT Biometric Wallet firmware, complete these verification steps to prevent device lockouts or asset loss.
Ticks are saved on this device only.
Frequently asked questions
Can my fingerprint recover a D’CENT wallet if the device is lost?
No. The fingerprint template is held inside the secure element on that specific device and cannot leave it. Restoring on a replacement device requires the recovery phrase written on your Recovery Sheet. D’CENT does not keep a copy and cannot reissue it.
How many fingerprints can be registered?
Up to two, according to the D’CENT shop specification checked on 9 September 2026. You can also skip biometrics and use a 4 to 8 digit PIN instead, which is offered as a direct alternative rather than an inferior fallback.
What happens if the fingerprint reader stops recognising my finger?
You fall back to the PIN. This is the failure owners describe most often in public reviews, including a three star Trustpilot review from 23 January 2026 where the reader would not read at all. D’CENT’s reply suggested re registering the print or switching to PIN only.
Is the D’CENT firmware open source?
No. It is closed, which is the main objection raised by experienced posters in the 2022 Bitcointalk thread about this device. It means nobody outside the company and its auditors can inspect what the device does with your keys.
What is the 25th word some owners mention?
An optional extra passphrase added on top of the 24 word recovery phrase, creating a separate set of accounts. It is a real feature and two Trustpilot reviewers cite it, but it is also another secret that is unrecoverable if forgotten, so it doubles what you must back up rather than replacing anything.
Does the fingerprint make the device harder to seize?
Not obviously. A biometric is something an attacker can use while your hand is present, which a PIN in your head is not. If that is part of your threat model, the PIN only mode exists for exactly this reason and the device supports it fully.
Finished the page? The same five questions from the top, to see what stuck.
This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. You are responsible for your own security decisions.
Leave a Reply