This is technically challenging. WordPress _must_ have access to your DB password in plain text. Having access to the `wp-config.php` contents is already a breach of security in progress.

There are alternate approaches to configuration, such as loading credentials via environment variables, but in practice they are used exceedingly rarely because PHP's configuration file is a reasonable solution already.

It's not clear why you assume someone will get access to the configuration file. As a low-hanging fruit, you can place it outside of the web accessible directory. WordPress will scan for the configuration file up one directory level above itself. For subdirectory installs, you could use `require` to load configuration content from elsewhere, but even that is rarely done.