Nearly 30 Indian investors who hold US stocks through the fintech platform Stockal have alleged that their shares were sold without their consent, with early estimates putting their combined losses at more than Rs 100 crore. The investors say holdings in top US companies such as Apple, Tesla, Nvidia, Amazon, Alphabet and AMD were sold on October 15, and the money was used to buy shares of a little-known Chinese company that later crashed.
Stockal has said the incident is under investigation and that it has found no evidence of a breach of its own systems. Its US brokerage partner, DriveWealth, has disputed responsibility. The case was first reported by Moneycontrol.
Stockal Unauthorised Trades: Key Details
| Platform | Stockal (Borderless Softech / Borderless Investing) |
| US broker and custodian | DriveWealth LLC |
| Date of trades | October 15, 2026, during US market hours |
| Accounts accessed | 26 |
| Accounts with unauthorised trades | 13 |
| Investors alleging losses | Nearly 30 |
| Estimated losses | Over Rs 100 crore (preliminary) |
| Shares sold | Apple, Tesla, Nvidia, Amazon, Alphabet, AMD |
| Shares bought | Zhibao Technology Inc (Nasdaq: ZBAO) |
| Legal action | FIR in Bengaluru; complaints to SEBI and US SEC |
What Happened to Stockal Investors?
According to the investors, blue-chip US shares in their accounts were sold during US trading hours on October 15 without any instruction from them. The money from these sales was then used to buy large quantities of Zhibao Technology Inc, a thinly traded Chinese company listed on Nasdaq.
Zhibao’s share price fell sharply in the days that followed. In one account, the shares were bought at an average price of $1.05, and the stock closed at $0.42 on October 23, a fall of about 60%.
Stockal’s parent company, Borderless, said an unauthorised third party accessed 26 customer accounts using valid login details, and trades were carried out in 13 of them. The company said DriveWealth flagged the suspicious transactions on October 16, India time, and that “no funds were withdrawn” from the accounts.
Investors Share Their Losses
A senior executive at a leading Indian beverage company said 10 of his US holdings, worth $335,768, were sold without his approval. The money was allegedly used to buy 300,000 shares of Zhibao at an average of $1.05 each. He claimed losses of about $450,000, or around Rs 4.26 crore, and said he did not receive the usual trade confirmation emails for these transactions.
Another investor said securities worth $3.1 million, or about Rs 29 crore, were sold within just two minutes, and the money was used to buy 30.5 lakh shares of a thinly traded stock within 15 minutes. This investor said neither the portfolio nor the losses have been restored so far.
The Rs 100 crore loss figure is a preliminary estimate based on information from investors and has not been independently verified.
What Stockal Said
In a statement posted on LinkedIn on November 4, Borderless said it had restricted access to the affected accounts and had found no evidence that its platform, infrastructure or internal systems were compromised. “Based on our investigation to date, no funds were withdrawn,” the company said.
Also Read: Best Stocks to Buy This Month
Stockal’s early assessment suggests that the hackers may have got hold of investors’ login details through compromised email accounts, phishing or other social engineering methods. The company is also looking into whether data exposed in an earlier breach at another company was used in the attack, though this link has not been confirmed.
Stockal said it has hired independent cybersecurity experts and added extra login and account-protection measures. It added that it is working with DriveWealth to review the trades and find possible solutions, but said this support should not be seen as an admission of liability.
DriveWealth Disputes Responsibility
DriveWealth, the US firm that holds the shares and clears trades for Stockal users, has taken a different view. In an October 30 letter to an affected investor, it said the unauthorised access happened through the investor’s Stockal interface and not through DriveWealth’s own systems, placing the responsibility for any security lapse on the Indian platform.
DriveWealth also reportedly claimed that some corrective steps were delayed because of instructions from Stockal. These claims are disputed, and it has not yet been established who is responsible for the trades.
FIR Filed, SEBI and US SEC Approached
An FIR has been registered in Bengaluru naming DriveWealth LLC, Stockal Securities, Borderless Softech Private Limited and Borderless Investing Inc. One investor has also approached India’s market regulator SEBI and the US Securities and Exchange Commission.
Many of the affected investors had opened their accounts through HDFC Securities’ global investing partnership with Stockal, which started in 2019. That partnership ended in July 2024. HDFC Securities has said it is not named as an accused in the case. Being named in an FIR does not establish criminal liability, and the investigation is still at an early stage.
Why This Case Matters for Indian Investors
More and more Indians are investing in US stocks through apps and fintech platforms under the RBI’s Liberalised Remittance Scheme (LRS). In most such setups, the Indian app only provides the interface, while a foreign broker holds the shares. This makes it harder for investors to know who is responsible when something goes wrong, and to seek help from Indian regulators.
The Stockal case shows how a single stolen login can lead to large losses within minutes, especially when there are no strong checks on unusual trades, such as selling an entire portfolio and buying a little-known penny stock.
Trending Article: Binance Hack Explained
Steps Investors on Overseas Platforms Can Take
- Turn on two-factor authentication on both the investing app and the email account linked to it.
- Use a strong, separate password for the investing account and the email ID.
- Never share OTPs or login details, and be careful of fake emails and calls claiming to be from the platform.
- Check the portfolio and trade confirmation emails regularly, and report any trade that was not placed by the account holder right away.
- Know which foreign broker holds the shares and how complaints can be raised with it.
Stockal and DriveWealth are expected to continue their reviews of the disputed trades, while the police investigation in Bengaluru is ongoing. Affected investors are waiting to learn whether their portfolios will be restored.
Disclaimer: This article is for information purposes only and is not investment advice. Investing in foreign stocks involves currency, market and platform risks. Please consult a SEBI-registered investment adviser before making any investment decision.