Security
Last updated 2026-10-14
MPC will never ask for your recovery phrase, private key or password, and will never ask you to send funds to receive anything. This application is served only from app.globalmpc.tech. Everything below is how to check that for yourself.
Official addresses
Nothing else is ours. A look-alike can contain the word “globalmpc” anywhere and still belong to someone else, so compare the whole host, ending to ending.
- This applicationapp.globalmpc.tech
- Company siteglobalmpc.tech
- Telegram groupt.me/official_mpc_global
- X accountx.com/MPC_Global_X
What MPC never asks for
Your recovery phrase, private key or keystore file
No screen in this application has a field for them, and no member of the team will ever ask for them in a message. Anyone who does is stealing your wallet, whatever name they are using.
A password
This application has no user password at all. You sign in with your wallet signature and a one-time code sent to your email address, so there is no password for anyone to ask you for.
A payment to receive your badge
Nobody from MPC will ask you to send funds to an address to receive, unlock or speed up your badge. Gas sponsorship and any optional wallet-paid network fee are explained in the issuance step before you approve a transaction.
Unexpected token approvals or transfers
MPC Unity can request signatures or transactions for certificates, check-in, quest rewards, cart dispatch, refining, registration, market orders, Ventures rewards and voting. Check that each request matches the action you started, the network and the contract shown by the app. An unexpected token approval, allowance increase or asset transfer is a reason to reject the request and verify it through official support.
To “verify”, “sync”, “migrate” or “unlock” your wallet
These phrases have no meaning in this flow. They exist to get you to sign something that drains the wallet. There is no recovery step here and there never will be.
Anything, in a message we sent first
We do not open direct messages, and we run no surprise airdrops or giveaways. Announcements come only from the channels listed above; a message from anywhere else is not from us, even if the display name matches exactly.
What MPC does ask for
These five, in this order, are the whole of joining. Anything asked outside this list is not part of it.
Connect your wallet
This shares your public address and network only. It moves nothing and approves nothing.
Sign one message to sign in
A sign-in signature, off chain and free — it is not a transaction. The message names the domain it belongs to. If your wallet shows any domain other than app.globalmpc.tech, reject it.
Connect Telegram, join the group, and follow on X
Telegram authentication opens Telegram’s own authorization page and returns only your verified Telegram identity to this site. If you are not in the community, this site then opens the official group and checks your membership when you return.
Enter your email and the six-digit code
The code goes to the address you typed and is only ever entered on this site. Nobody from MPC will ask you to read it out, forward it or paste it into a chat.
Sign the badge issuance
One more signature, carried for you by a relayer, so no gas leaves your wallet. It sends no funds and grants no spending allowance.
The Telegram step, in full
This step is the easiest to imitate: the real one hands you a personal link and, on some computers, asks you to paste it into Telegram yourself.
If Telegram login does not work, try another login option
On Telegram’s Login options screen, select Log in with a phone number and press Continue, then follow Telegram’s verification instructions. Or select Scan a QR code and press Continue. Display the login QR on another device and scan it with your signed-in Telegram app; follow the prompt to approve. The app’s Settings > Devices offers a QR scanner (the label may vary). If the request expires, return to this site and start Connect Telegram again.
If the group does not open, use its link or group QR
In the join screen, expand Trouble opening the group? to open or copy the group link, or scan the group QR with your phone camera. If the app does not open, copy the link and open it in Telegram. The group QR opens the community; it is different from Telegram’s login QR and does not authenticate your account. Join, return to the original browser and press Check again. If your account is not connected yet, complete Connect Telegram first.
Telegram authentication happens on Telegram
Connect Telegram redirects you to oauth.telegram.org. Telegram asks you to approve sharing your identity, then returns you to this application. Do not approve a Telegram sign-in reached from a forwarded link or an unexpected message.
Connecting your identity does not join the group
If Telegram says you are not a member, this application shows the official group link listed above. Telegram still requires you to press Join; neither this site nor the bot can add your account without that action.
The bot never needs a private chat with you
You do not send /start, your wallet address, a recovery phrase, a payment or a code to the bot. The backend uses the bot only to ask Telegram whether the authenticated Telegram user is in the official group.
Membership is checked again after you return
Opening the group is not proof by itself. After you join, return to this application and press Check again; the backend asks Telegram for your current member status before letting the flow continue.
After you join: check-in and quests
Joining happens once. These are the requests you will see every day, so they are worth recognising.
Quests send you out to read, follow or post — never to connect a wallet
A quest can only link to the hosts listed above — the allow list is enforced on our server and its core entries cannot be deleted by an administrator. Whatever it sends you to look at, the signature that credits it happens back here.
Check-ins, quests and energy are signatures, not payments
Each is one typed-data signature that a relayer submits for you, so no gas leaves your wallet. It names one of our contracts and carries your address, the relayer allowed to submit it, a one-time challenge and a deadline. It moves no tokens and grants no allowance.
Paying for it yourself is only ever offered here, after the relayer fails
When the relayer cannot carry a transaction, this application offers to let you send it yourself, and then you pay the network fee — to the network. That offer appears on the screen you are already looking at, never as a message, and never asks you to send funds to an address.
How to check you are in the right place
Our server refuses work sent from anywhere else
A copied site can imitate these screens, but sign-in, email verification and issuance are rejected unless the request comes from the official address. A clone cannot complete them against us.
Check the domain your wallet shows you
Wallets print the requesting domain on every signature and transaction. That line is written by your wallet, not by the page, so it is the one thing a fake site cannot forge. Read it every time.
https://app.globalmpc.tech/security
app.globalmpc.tech
If it already happened
If you entered your recovery phrase or private key anywhere, treat that wallet as lost. Move whatever it still holds to a wallet created fresh on a device you trust. This cannot be undone by us or by anyone else, and speed is the only thing that helps.
If you approved a transaction you do not recognise, revoke the approval from your wallet or a revocation tool, then move the assets it covered.
Then tell us at mpc@globalmpc.tech, with the address you were sent to. It will not recover your funds, but it lets us warn everyone else.
Reporting a vulnerability
Send security reports to mpc@globalmpc.tech. Include the steps to reproduce and the addresses or requests involved. We read reports in English.
We ask for coordinated disclosure: tell us first, and hold public description until the issue is fixed. Testing must stay within your own account — it must not degrade the service for other users or reach anyone else’s data.
Our machine-readable contact details are published at https://app.globalmpc.tech/.well-known/security.txt.