One Kit, One Borrowed Company Number: NarwhalSwap, MindChain Swap and 14 More Fake Exchanges
BlockintAI · 2026-10-22T14:59:53.696Z
BlockintAI research. Site and registration checks were made on Thursday, October 22, 2026, between 7:03 AM and 8:16 AM Central Time (CT). Registration-record (RDAP), certificate-log and urlscan dates are UTC unless marked CT.
BlockintAI has been tracking a family of fake cryptocurrency exchanges built on one shared web kit, which we call the "calm-ui" kit. Three sites running one build of that kit, arunacoin[.]com, charix[.]org and diabasecoin[.]com, are now on registrar hold. NiceNIC's registration records show all three on client hold. The records were last changed on October 20, 2026 (arunacoin[.]com and charix[.]org) and October 5, 2026 (diabasecoin[.]com).
The same application file is still being served by a site that was live on October 22: NarwhalSwap, at narwhalswap[.]org. It promises "Guaranteed income" from staking "without risking your principal," and its legal pages name a UK company.
NarwhalSwap is not alone. The same file runs on MindChain Swap (mindchainswap[.]com), and the same company footer appears on ten more live kit sites. On October 22, BlockintAI reported NarwhalSwap, MindChain Swap and nine related sites to their registrars, to Google Safe Browsing and to Netcraft.
Key facts
| Main site | NarwhalSwap (narwhalswap[.]org), presented as a crypto exchange and swap platform |
| Status | Live on Oct 22, 2026 (last checked 8:16 AM CT) |
| Registrar | NiceNIC International Group. Registered Feb 19, 2026; record last changed Aug 12, 2026 |
| Shared code | assets/js/main.js?v=3, SHA-256 312c9480…b40d |
| Same file as | arunacoin[.]com, charix[.]org and diabasecoin[.]com (on registrar hold), plus MindChain Swap (mindchainswap[.]com) and orlchain[.]com (live) |
| Displayed returns | /earn: "Guaranteed income" and "Profit daily by keeping your funds in staking-pool without risking your principal" |
| Displayed company | /info names a real UK-registered company and its company number; the same UK company appears on MindChain Swap (mindchainswap[.]com) and ten other live kit sites |
| Reports | NarwhalSwap and MindChain Swap: NiceNIC 7:22 AM CT, Netcraft 7:23 AM CT, Google Safe Browsing 7:25 AM CT. Nine related sites: registrars, Google Safe Browsing and Netcraft, 7:41–7:49 AM CT |
One file, four sites
The calm-ui kit is a multi-brand fake-exchange panel. Each brand gets its own domain, logo and color scheme, but underneath, the sites run the same application. On October 18 we documented the kit across a cluster of live sites and logged arunacoin[.]com and charix[.]org as running a variant build that loads main.js?v=3 instead of the core build's script. urlscan's public scans of both sites record that file with this SHA-256 fingerprint (arunacoin[.]com at 4:22 AM CT and charix[.]org at 4:37 AM CT on October 18):
312c94806fe277640fdcef8040ce6ed8e428064dd92c8866f3bafb84b797b40d
A file hash is a fingerprint of its exact contents. Change one character and the hash changes completely. Two sites serving a file with the same hash are serving the same file, byte for byte.
In urlscan's public scan archive, scans made before October 22 show that file on four domains:
| Domain | urlscan public scans with the file |
|---|---|
| arunacoin[.]com | Oct 16 to Oct 19, 2026 |
| charix[.]org | Oct 12 to Oct 20, 2026 |
| diabasecoin[.]com | Sept 30, 2026 |
| narwhalswap[.]org | Oct 20, 2026, 08:21 UTC |
The first three are on registrar hold. The fourth was live.
Our own fetch of narwhalswap[.]org on October 22 at 8:05 AM CT returned the same main.js?v=3, with the same SHA-256 hash. The site's skin is its own (it is titled "NarwhalSwap — Digital Asset Markets"), but it shares the kit's other tell-tale markers: a Java session cookie (JSESSIONID), the kit's sign-in, sign-up, markets, swap, earn and futures pages, and a favicon stored under the kit's numbered "tenant" naming scheme (domain_icons/8_…).
What the site promises
NarwhalSwap has a public /earn page. On October 22 it displayed:
"Guaranteed income"
"Profit daily by keeping your funds in staking-pool without risking your principal"
The page also advertises lending, marked "Soon", "at interest rates ranging from 0.3% to 24.85% of revenue."
No real crypto product can guarantee income, and staking always carries risk to what you put in. A promise of guaranteed, risk-free daily profit is one of the clearest signs of a fake platform.
The /earn page of narwhalswap[.]org, Oct 22, 2026, 7:13 AM CT.
A borrowed company number
NarwhalSwap's /info page carries compliance, privacy and terms sections that tie the brand to a real UK-registered company. The page says NarwhalSwap "operates through" that company, and its footer gives the company's name and its company number.
Companies House lists that company as a management consultancy (SIC 70229). We have no indication it is involved.
A management consultancy is not a crypto exchange. A UK company name on a legal page proves nothing on its own: anyone can paste a real company's name and number into a website. Look the number up yourself, and check whether the business it describes matches the site.
The /info compliance page of narwhalswap[.]org, "Regulatory status" section and footer, Oct 22, 2026, 8:11 AM CT. BlockintAI blacked out the company name and number.
An old crypto name on a new registration
The NarwhalSwap name was used before. Public certificate logs show certificates for narwhalswap[.]org and its subdomains from September 2020, when a Narwhalswap decentralized exchange on Binance Smart Chain announced its launch. We have no indication that project is involved.
The domain was registered again on February 19, 2026, according to NiceNIC's registration record, and new certificates were issued for it the same day, after a gap in the certificate logs since October 2024. A name that once belonged to a real crypto project can look established in a search result or a chat message. The registration date tells a different story.
The same file and footer on MindChain Swap
MindChain Swap (mindchainswap[.]com) runs the same kit. On October 22 its assets/js/main.js?v=3 had the same SHA-256 hash as NarwhalSwap's and the three held sites', 312c9480…b40d, so it is the same file, byte for byte. Its /info page names the same UK company, with the same company number, in its footer and in its "Regulatory status" section. Its /earn page displays the same "Guaranteed income" pitch.
A shared kit means shared code and shared boilerplate. It does not on its own show that the same people run each site, and we make no claim that they do.
mindchainswap[.]com was previously used by an earlier, unrelated project; we have no indication that the earlier Mindchain project (mindchain[.]info) is involved. NiceNIC's registration record shows the current registration was created on August 26, 2026.
The /info compliance page of mindchainswap[.]com, "Regulatory status" section and footer, Oct 22, 2026, 8:11 AM CT. BlockintAI blacked out the company name and number.
Ten more sites with the same footer
On October 22 the same UK company and company number were in the /info footer of ten more live kit sites. We reported five of them that morning, between 7:41 and 7:49 AM CT; each of those five also displayed the "Guaranteed income" text on its /earn page. The other five were reported to their registrars on October 18, 2026, and still showed the footer when we checked them at 8:12 AM CT on October 22.
| Domain | Kit file match | Registrar | Reported |
|---|---|---|---|
| orlchain[.]com | Same main.js?v=3 (312c9480…b40d) as NarwhalSwap |
NiceNIC | Oct 22, 2026 |
| hederabit[.]com | Same main.js?v=7 (43a968ec…a7db) as dexgeto[.]com |
Dominet (HK) | Oct 22, 2026 |
| cregox[.]com | Same main.js?v=7 as dexgeto[.]com |
Dynadot | Oct 22, 2026 |
| wusegua[.]com | Same main.js?v=7 as dexgeto[.]com |
NameSilo | Oct 22, 2026 |
| cryptoline[.]cc | Same main.js?v=7 as dexgeto[.]com |
NiceNIC | Oct 22, 2026 |
| dexgeto[.]com | main.js 43a968ec…a7db |
Eranet | Oct 18, 2026 |
| bitnax[.]io | Same main.js (43a968ec…a7db) as dexgeto[.]com |
NiceNIC | Oct 18, 2026 |
| coinsco[.]io | Same main.js (43a968ec…a7db) as dexgeto[.]com |
NiceNIC | Oct 18, 2026 |
| nexoex[.]io | Same main.js (43a968ec…a7db) as dexgeto[.]com |
NiceNIC | Oct 18, 2026 |
| cryptolane[.]org | Same main.js (43a968ec…a7db) as dexgeto[.]com |
Key-Systems | Oct 18, 2026 |
dexgeto[.]com is the calm-ui kit site described in our earlier DEXGETO post.
Four related sites without the footer
We reported four more sites the same morning: bitgaz[.]com, celobit[.]com, miomex[.]com and wexkey[.]com. They do not display the same UK company. They run a related build of the kit: their app code largely matches a kit site we documented on October 18, and bitgaz[.]com and wexkey[.]com serve a byte-identical noti.js?v=3 file. All four /earn pages display the same "Guaranteed income" and "without risking your principal" text.
The user agreements on celobit[.]com and wexkey[.]com say an account can become "subject to a tax audit" with a requirement to be met "up to 48 hours from the moment the User receives the notification." A sudden "tax" or "audit" demand before a withdrawal is a common way fake platforms extract one more payment.
Where things stand
| Domain | Status as checked Oct 22, 2026, 8:14–8:16 AM CT |
|---|---|
| narwhalswap[.]org | Live (8:16 AM CT); reported to NiceNIC, Netcraft and Google Safe Browsing |
| MindChain Swap (mindchainswap[.]com) | Live (8:16 AM CT); reported to NiceNIC, Netcraft and Google Safe Browsing |
| orlchain[.]com, hederabit[.]com, cregox[.]com, wusegua[.]com, cryptoline[.]cc | Live (8:16 AM CT); reported to their registrars, Google Safe Browsing and Netcraft |
| dexgeto[.]com, bitnax[.]io, coinsco[.]io, nexoex[.]io, cryptolane[.]org | Live with the footer (8:12 AM CT); reported to their registrars on Oct 18, 2026 |
| bitgaz[.]com, celobit[.]com, miomex[.]com, wexkey[.]com | Live (8:16 AM CT); reported to their registrars, Google Safe Browsing and Netcraft |
| arunacoin[.]com | On hold at NiceNIC (record last changed Oct 20, 2026) |
| charix[.]org | On hold at NiceNIC (record last changed Oct 20, 2026) |
| diabasecoin[.]com | On hold at NiceNIC (record last changed Oct 5, 2026) |
BlockintAI reported narwhalswap[.]org and mindchainswap[.]com to NiceNIC's abuse team at 7:22 AM CT and to Netcraft at 7:23 AM CT on October 22, 2026, and to Google Safe Browsing at 7:25 AM CT. We reported the nine related sites to their registrars, to Google Safe Browsing and to Netcraft between 7:41 and 7:49 AM CT.
Our earlier reports on this kit are on blockint.ai: the calm-ui kit follow-up and the Charix report. For how the kit works and the withdrawal-fee trap reported on one of its brands, see our post on the DEXGETO fake-exchange kit.
What gives these sites away
- A guarantee. "Guaranteed income" and profit "without risking your principal" are not things a real crypto platform can promise.
- A company that doesn't fit. A crypto exchange whose legal page names a management consultancy is a red flag. So is one company number on many differently named exchanges. Look a company number up yourself.
- A borrowed name on a fresh domain. An old crypto brand on a domain registered this year is a reused name, not a track record.
- A "tax" before withdrawal. A demand to pay a fee, tax or audit charge before you can withdraw is a sign the money is not coming back.
- A familiar template. The page title "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | <brand>" is the calm-ui kit's default. It was on all three held sites. Some kit sites, NarwhalSwap among them, use their own English title, so check the other signs too.
If you have lost money
If you deposited funds on any of the sites named here or a site that looks like them, stop sending money, including any "fee" or "tax" the site says you must pay to withdraw. Keep your transaction IDs, screenshots and chat history.
Report it to the FBI's Internet Crime Complaint Center at ic3.gov and to the FTC at reportfraud.ftc.gov, and file a report at blockint.ai: https://blockint.ai/c3?mode=file
Sources
- narwhalswap[.]org and mindchainswap[.]com public pages (/, /earn, /info) and
assets/js/main.js?v=3, fetched Oct 22, 2026, 7:03–8:16 AM CT (screenshots 7:13 and 8:11 AM CT) - Public pages (/, /earn, /info or /regulatory, user agreement) and app files of orlchain[.]com, hederabit[.]com, cregox[.]com, wusegua[.]com, cryptoline[.]cc, bitgaz[.]com, celobit[.]com, miomex[.]com and wexkey[.]com, fetched Oct 22, 2026, 7:18–8:16 AM CT
- /info pages and app files of dexgeto[.]com, bitnax[.]io, coinsco[.]io, nexoex[.]io and cryptolane[.]org, fetched Oct 22, 2026, 7:17–8:12 AM CT; their registrars and Oct 18 filings are from BlockintAI's Oct 18, 2026 takedown records
- RDAP registration records for all domains named here, checked Oct 22, 2026, 7:25–8:16 AM CT
- urlscan.io public scan search for SHA-256 312c94806fe277640fdcef8040ce6ed8e428064dd92c8866f3bafb84b797b40d: https://urlscan.io/search/#hash%3A312c94806fe277640fdcef8040ce6ed8e428064dd92c8866f3bafb84b797b40d
- UK Companies House public register: https://find-and-update.company-information.service.gov.uk/ (checked Oct 22, 2026)
- Certificate Transparency logs (crt.sh) for narwhalswap[.]org and mindchainswap[.]com
- Earlier project using the NarwhalSwap name: Narwhalswap on Medium, "Introduction to Narwhalswap" (Sep 28, 2020): https://medium.com/narwhalswap/introduction-to-narwhalswap-50fc4a2ca83f
- BlockintAI calm-ui kit follow-up report: https://blockint.ai/c3?report=46d3924c-8475-4217-87ec-f645a0dbbdaa
- BlockintAI Charix report: https://blockint.ai/c3?report=76941b24-8724-4bf4-a6df-fb127ca9f9f1
- BlockintAI blog, DEXGETO fake-exchange kit: https://blockint.ai/blog/dexgeto-aml-verification-fake-exchange-kit