blockintAI · Research blog

Same Kit, New Names: MindChain Swap and NarwhalSwap Run the Code of Fake Exchanges Already on Hold

BlockintAI · 2026-10-23T01:37:19.153Z

BlockintAI research. Site, DNS and registration checks were made on Thursday, October 22, 2026, between 6:53 AM and 7:18 AM Central Time (CT). Registration-record (RDAP), certificate-log and urlscan dates are UTC.

BlockintAI has been tracking a family of fake cryptocurrency exchanges built on one shared web kit, which we call the "calm-ui" kit. Three sites on one build of that kit, arunacoin[.]com, charix[.]org and diabasecoin[.]com, are now on registrar hold: NiceNIC's registration records show arunacoin[.]com and charix[.]org on hold since October 20, 2026, and diabasecoin[.]com since October 5, 2026.

The kit didn't go away with them. On the morning of October 22, the exact same application file was still being served by two live "exchanges": MindChain Swap at mindchainswap[.]com and NarwhalSwap at narwhalswap[.]org.

Both sites promise "Guaranteed income" from staking "without risking your principal." Both display the same UK company name and company number on their legal pages. And both use the names of crypto projects that existed years ago, on domains that were registered again in 2026.

BlockintAI reported both domains to NiceNIC on October 22, 2026 at 7:23 AM CT.

Key facts
The sites MindChain Swap (mindchainswap[.]com) and NarwhalSwap (narwhalswap[.]org), presented as crypto exchange and swap platforms
Status Both live on Oct 22, 2026 (last checked 7:18 AM CT), behind Cloudflare
Registrar NiceNIC International Group for both. mindchainswap[.]com registered Aug 26, 2026; narwhalswap[.]org registered Feb 19, 2026 (record last changed Aug 12, 2026)
Shared code Byte-identical assets/js/main.js?v=3 (SHA-256 312c9480…b40d) and assets/js/support.js?v=2 on both sites
Same kit as arunacoin[.]com, charix[.]org and diabasecoin[.]com, which served the same files and are now on registrar hold
Displayed returns Both /earn pages: "Guaranteed income" and "Profit daily by keeping your funds in staking-pool without risking your principal"
Displayed company Both /info pages: "DIGITALK DASH Limited · Co. No. 14018271"
Reports NiceNIC abuse report sent Oct 22, 2026, 7:23 AM CT, covering both domains. Netcraft report submitted 7:23 AM CT; Google Safe Browsing reports (one per site) 7:25 AM CT

How we found it: one file, five sites

The calm-ui kit is a multi-brand fake-exchange panel. Each brand gets its own domain, logo and color scheme, but underneath, the sites run the same application. On October 18 we documented its core build across a cluster of live sites, and logged arunacoin[.]com and charix[.]org as running a variant build of the same kit: instead of the core build's script, both served a different file, main.js?v=3.

That variant file is what led to MindChain Swap.

On October 22 at 6:53 AM CT, mindchainswap[.]com served the page title "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | MindChain Swap." That is the kit's title template word for word, with only the brand name swapped in. The site's assets/js/main.js?v=3 file had the SHA-256 fingerprint:

312c94806fe277640fdcef8040ce6ed8e428064dd92c8866f3bafb84b797b40d

A file hash is a fingerprint of its exact contents. Change one character and the hash changes completely. Two sites serving a file with the same hash are serving the same file, byte for byte.

We then searched urlscan's public scan archive for that hash. It returned four domains: arunacoin[.]com (scans from Oct 16 to Oct 19), charix[.]org (Oct 12 to Oct 20), diabasecoin[.]com (Sept 30) and one we hadn't seen before, narwhalswap[.]org (Oct 20). The first three are already on registrar hold. The fourth was live.

Our own checks on October 22 at 7:04 AM CT confirmed the match. NarwhalSwap's main.js?v=3 and support.js?v=2 are byte-identical to MindChain Swap's. The two sites' page code is nearly the same as well: more than 1,400 of 1,575 non-blank home-page lines and 2,534 of 2,699 lines on the /info page are shared. The skins differ (NarwhalSwap is titled "NarwhalSwap — Digital Asset Markets" and uses a different landing-page design), but the application behind them is one and the same.

Both sites also share the kit's other tell-tale markers: a Java session cookie (JSESSIONID), the same sign-in, sign-up, markets, swap, earn and futures pages, and favicons stored under the kit's numbered "tenant" naming scheme (domain_icons/13_… on MindChain Swap, domain_icons/8_… on NarwhalSwap).

What the sites promise

Both sites have a public /earn page. On October 22 at 7:13 AM CT, both displayed the same pitch:

"Guaranteed income"

"Profit daily by keeping your funds in staking-pool without risking your principal"

The page also offers lending "at interest rates ranging from 0.3% to 24.85% of revenue."

No real crypto product can guarantee income, and staking always carries risk to what you put in. A promise of guaranteed, risk-free daily profit is one of the clearest signs of a fake platform.

MindChain Swap and NarwhalSwap /earn pages side by side

The /earn pages of mindchainswap[.]com and narwhalswap[.]org, Oct 22, 2026, 7:13 AM CT.

Two "exchanges," one company

Each site's /info page carries compliance, privacy and terms sections that tie the brand to a British company. MindChain Swap's says "MindChain Swap operates through DIGITALK DASH Limited, a UK company." NarwhalSwap's says "NarwhalSwap operates through DIGITALK DASH Limited, a UK company." Both footers read "DIGITALK DASH Limited · Co. No. 14018271."

Both sites' public /info page displays the company name "DIGITALK DASH Limited" and company number 14018271. UK Companies House lists company 14018271, DIGITALK DASH LIMITED, as an active private limited company incorporated on 1 April 2022, with nature of business SIC 70229 "Management consultancy activities other than financial management" (checked 22 October 2026). We have no indication that this company is involved.

Two differently named exchanges, on two different domains, presenting the same company name and number is not what independent businesses look like. It is what a kit looks like: the same legal boilerplate pasted into each new brand.

MindChain Swap and NarwhalSwap /info compliance sections side by side

The /info compliance sections of both sites, Oct 22, 2026, 7:03 AM CT.

Old crypto names on new registrations

Both brand names were used before. Public certificate logs show certificates for mindchainswap[.]com and its subdomains from June 2022, and a "MindchainSwap" decentralized exchange on BNB Chain has been described publicly under that name. They show certificates for narwhalswap[.]org and its subdomains from September 2020, when a Narwhalswap decentralized exchange on Binance Smart Chain announced its launch. We have no indication those projects are involved.

Both domains were registered again in 2026. NiceNIC's registration record shows mindchainswap[.]com created on August 26, 2026, and the current site's certificates start the same day. narwhalswap[.]org was registered on February 19, 2026, and new certificates were issued for it the same day, after a gap in the certificate logs since October 2024.

A name that once belonged to a real crypto project can look established in a search result or a chat message. The registration date tells a different story.

Where things stand

As of 7:18 AM CT on October 22, 2026, both sites were live. Both sit behind Cloudflare, which hides the servers that actually host them, and both are registered through NiceNIC.

Domain Status (Oct 22, 2026)
mindchainswap[.]com Live; reported to NiceNIC Oct 22, 7:23 AM CT
narwhalswap[.]org Live; reported to NiceNIC Oct 22, 7:23 AM CT
arunacoin[.]com On hold at NiceNIC since Oct 20, 2026
charix[.]org On hold at NiceNIC since Oct 20, 2026
diabasecoin[.]com On registrar hold since Oct 5, 2026

BlockintAI reported mindchainswap[.]com and narwhalswap[.]org to NiceNIC's abuse team on October 22, 2026 at 7:23 AM CT. We also reported both sites to Netcraft at 7:23 AM CT and to Google Safe Browsing at 7:25 AM CT. Our C3 report on mindchainswap[.]com and narwhalswap[.]org is on blockint.ai: https://blockint.ai/c3?report=4d17789d-e7b2-4461-9c0f-0fdc15ab680d.

Our earlier reports on this kit are on blockint.ai: the calm-ui kit follow-up and the Charix report. For how the kit works and the withdrawal-fee trap reported on one of its brands, see our post on the DEXGETO fake-exchange kit.

What gives these sites away

  • A guarantee. "Guaranteed income" and profit "without risking your principal" are not things a real crypto platform can promise.
  • A shared identity. Two exchanges with different names that display the same company name and number are a red flag. Look a company number up yourself.
  • A borrowed name on a fresh domain. An old crypto brand on a domain registered this year is a reused name, not a track record.
  • A familiar template. The page title "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | <brand>" is the calm-ui kit's default. It was on MindChain Swap and on all three held sites; NarwhalSwap uses its own title.

If you have lost money

If you deposited funds on mindchainswap[.]com, narwhalswap[.]org or a site that looks like them, stop sending money, including any "fee" or "tax" the site says you must pay to withdraw. Keep your transaction IDs, screenshots and chat history.

Report it to the FBI's Internet Crime Complaint Center at ic3.gov and to the FTC at reportfraud.ftc.gov, and file a report at blockint.ai: https://blockint.ai/c3?mode=file

Sources