Did you find this article helpful?
If it clarified even one security risk for you, consider sharing it with others who may benefit 😎
⬇️⬇️⬇️⬇️⬇️
Key Answer — This update is about stopping the accident that costs crypto users the most: sending to the wrong address. Detection is based on known malicious addresses and works as a second pair of eyes — the final check before you send is still yours.
- Risky addresses get flagged early — checked against known spam and phishing addresses before you send.
- Risk shows up in your history too — suspicious transactions carry a visible risk label.
- Block and report without leaving the app — no external sites needed.
- Forgot your XRP tag? — the app asks once more before your funds go missing.
- Smaller guards ship too — recent recipient autocomplete, per-chain reserve notices, and auto-recalculated Max amounts.
Everything ships on by default in the latest mobile app.
The moment crypto disappears is rarely dramatic. Most of the time, it happens in the few seconds after you tap Send.
You paste an address — and it turns out to be a different one that was sitting in your clipboard. You send XRP to an exchange and forget the tag (the number the exchange uses to recognize your account). A plausible-looking address arrives from somewhere, and you send without a second thought.
We covered why crypto transfers are so hard to undo in Crypto Class 3 — One Wrong Send: Can You Undo It? This update is the next step: the app now takes over the careful habits that article asked you to build.
What Is Address Poisoning — and Why Your Own History Betrays You
Address poisoning is the attack behind most "but I copied the right address" stories. An attacker sends you a dust-sized transaction from an address that shares the first and last few characters of one you use often. It lands in your transaction history, looking familiar. The next time you copy an address from that history, you copy theirs.
It is not a fringe problem. Chainalysis has traced a single address poisoning campaign across tens of thousands of targeted addresses, and Blockaid reports poisoning attempts multiplying several-fold in a matter of months.
Clipboard-hijacking malware attacks the same blind spot from the other side: it swaps the address you copied in the fraction of a second before you paste it. Both rely on the same habit — glancing at the first four characters and the last four, and trusting them. If you want the wider picture, we collected the common patterns in how to avoid crypto scams with a hardware wallet.
In May, D'CENT added Blockaid real-time verification right before you sign. This time the defense moves one step earlier — the moment you handle an address.
Risky Addresses, Flagged Before You Send
Spam and phishing address detection is now built into D'CENT. When you enter or copy an address on the send screen, the app automatically checks it against a list of known malicious addresses. If it matches, you get a warning on the spot.
The same goes for your transaction history. Suspicious entries carry a colored risk label, so the ones worth a closer look stand out at a glance.
At the send confirmation step, the transaction itself gets one more check. Threat verification runs automatically before you hit Send, and a "No threat detected" badge appears when it comes back clean.
Real D'CENT app — verification runs automatically before sending (left), and a "No threat detected" badge appears when it's clean (right). Verification is powered by Blockaid.
When something is off, it doesn't pass quietly. A warning banner appears, and Vaulty — the in-app assistant — nudges you to review carefully.
Real D'CENT app — when the simulation detects an issue, a warning banner asks you to take another look.
You can review and manage the feature under the Security section in Settings.
See Something Suspicious? Block It in the App
Found a shady address? No need to hunt for an external site. Here is how to block a scam address in D'CENT:
1
Open Settings → Security → Blocked addresses and tap Add.
2
Pick the network the address belongs to.
3
Give it a name you'll recognize later, then paste the address.
4
Save. It's blocked on that network — and your Address Book will refuse to save it as a contact.
You can also report suspicious addresses right from the app; reports go to our support team for review.
Real D'CENT app — network, name, address. Three steps and the block is registered.
It's wired into your Address Book too. Try to save a blocked address as a contact, and the app steps in first. The Address Book added in May just got a layer safer.
Forgot Your XRP Tag? One More Question Before It's Gone
A destination tag, as the XRP Ledger documentation explains, is how a shared exchange address tells one customer's deposit from another's. Leave it out and the coins arrive at the exchange — but never reach your account. Getting them back means going through the exchange's support desk, and it takes a long time.
Now, if you try to send XRP without a tag, D'CENT checks first. If the recipient account requires a tag, a warning blocks the way until you explicitly confirm — and even when it doesn't, the app double-checks once: "Is this going to an exchange?" That one question can save you a days-long support ticket.
Moving XRP the other way, from an exchange into your wallet? We walk through it in how to withdraw XRP from Coinbase to D'CENT.
Real D'CENT app — the XRP send screen includes a tag field with guidance (left), and if you're unsure, Vaulty explains exactly when a tag is required (right).
Small Guards All Over the Send Screen
Several quieter safeguards shipped alongside the headline features.
Recent recipient autocomplete
addresses you've sent to recently appear as you type, cutting down on paste mistakes.
Reserve notices per chain
for chains like Solana (SOL), Algorand (ALGO), Polkadot (DOT), NEAR, Stacks (STX), and Stellar (XLM) that require a minimum balance, the send and receive screens explain the rule up front.
Change the fee after sending Max?
the amount recalculates automatically, so fewer transfers fail over fees.
What It Doesn't Catch
Honesty matters more than marketing here.
- Brand-new addresses slip through. Detection is based on known malicious addresses. A scam address created minutes ago may not be on the list yet.
- A warning is a signal, not a verdict. No warning doesn't mean an address is 100% safe.
- The last call is still yours. These features are a second pair of eyes — not a replacement for the first.
- Approvals you already signed stay signed. Address detection looks at where funds are going, not at permissions you granted in the past — clear those separately with token approval revoke, built into the app.
Your Keys Are the Hardware's Job. The Address Moment Is the App's.
A hardware wallet stops attackers from stealing your private key. It does not stop you from sending to the wrong address with your own hands. That's exactly the gap this update closes.
When you enter an address
malicious address detection, recent recipient autocomplete
Right before you send
XRP tag check, reserve notices, amount recalculation
Right before you sign
Blockaid real-time verification (May update)
For why a signature itself can be dangerous, see Crypto Class 4 — This Signature: Is It Safe?
FAQ
What is address poisoning, and does D'CENT stop it?
Address poisoning is when an attacker sends you a tiny transaction from an address that mimics the first and last characters of one you use often, hoping you'll copy it out of your history later. D'CENT checks the address you enter against known malicious address lists and warns you before you send. Addresses created too recently to be on any list can still slip through, so the visual check is still worth the three seconds.
Does D'CENT catch clipboard-swapped addresses?
If the swapped-in address is already on a known malicious list, yes — you'll get a warning at entry and again at confirmation. If it's brand new, no list has it yet. Recent recipient autocomplete helps here: pulling an address you've already used beats pasting one every time.
I sent XRP without a destination tag. Can I get it back?
Usually yes, but not by yourself. The funds reached the exchange and simply weren't credited to your account, so contact the exchange's support with the transaction ID, the amount, and proof that the sending wallet is yours. Expect it to take a while — which is exactly why the app now asks before you send without a tag.
What if a legitimate address gets flagged?
You can add it to your allow list as an exception, and any address you blocked by mistake can be removed at any time.
Which chains are supported?
Address detection currently focuses on EVM-family chains, and you can block or report addresses on your chosen network.
Does my report apply to other users immediately?
No. Reports are routed to our support team for review, and whether they feed into the protection list depends on that review.
Can I turn detection off?
It's managed under the Security section in Settings. We recommend leaving it on — the warnings aren't friction, they're the last safety net.
Do these features cost anything?
No. They're part of the app update, at no extra cost.
Does this change the hardware security model?
No. Signing, recovery, and the EAL5+ secure element work exactly as before. These features handle display and warnings before anything is signed.
How to Get It
If you already use D'CENT, the latest App Store or Google Play update brings everything — on by default, nothing to configure.
The same update also brought NFT transfers, DeFi position tracking, and custom networks — see Send NFTs, Track DeFi, Add Any Network.
One more question before you send — now the app asks it for you.
DCENT S · Card-type cold wallet
Carry it daily, Recover it always
Seedless setup · R3covery backup card included · 100+ networks · 4,900+ assets
Meet DCENT S →Keep it safe. Use it freely. What is DCENT S?
