Stockal’s US Trading Row: Missing Consent, A Chinese Microcap, And Unanswered Questions

Indian investors who held Apple, Amazon, Tesla, and Nvidia shares allege they logged into their Stockal accounts to find those investments replaced with shares of a thinly traded Chinese microcap.

Nearly 30 investors say their portfolios were altered without consent on October 15. Their established US stock holdings were allegedly liquidated and the proceeds used to buy Nasdaq-listed Zhibao Technology shares.

One investor told Moneycontrol that securities worth $3.1 Mn, or around ₹29 Cr, were sold within two minutes, followed by purchases of 30.5 Lakh Zhibao shares within 15 minutes. Another reported that holdings worth $335,768 were sold and 3 Lakh Zhibao shares purchased.

Media reports put investor-reported losses above ₹100 Cr. Inc42 has not independently verified this aggregate or authenticated the investors’ account details and alleged transactions.

An FIR has reportedly been registered in Bengaluru. The dispute now centres on how the accounts were accessed, whether safeguards failed, and who bears responsibility across Stockal, its parent Borderless Investing, and US brokerage partner DriveWealth.

How The Trades Unfolded

Founded in 2016 by Sitashwa Srivastava and Vinay Bharathwaj, Stockal enables Indians to invest overseas through US stocks, exchange-traded funds, and curated portfolios. It has raised over $9 Mn from investors like ScaleX Partners, Arc Ventures, July Ventures, HDFC Securities, and Cadenza Ventures. The startup partners with DriveWealth to facilitate US stock investments.

Xxxx

Bharathwaj left Borderless in 2022 and is currently the founder and CEO of “AI-first money intelligence and advisory platform” Cruise Money, as per his LinkedIn profile.

Investors allege the October 15 transactions replaced holdings in companies including Alphabet and AMD with Zhibao shares, leaving them exposed to a thinly traded microcap.

Borderless said DriveWealth notified it on October 16, India time, of suspicious trading across 13 accounts. Its assessment indicated an unauthorised third party had accessed 26 accounts using valid login credentials.

In 13 accounts, large-cap US equities were liquidated to acquire thinly traded microcap securities. Borderless said it restricted access shortly after receiving the notification.

An investor told Moneycontrol that Borderless contacted him on October 18, acknowledged suspicious activity, and said DriveWealth had restricted transactions in his account.

Zhibao’s subsequent decline deepened investors’ reported losses. Against an average purchase price of around $1.05 cited in investor accounts, the shares closed at $0.42 on October 23 — a fall of approximately 60%.

Differing Accounts Of Access

In an October 30 letter to an investor, DriveWealth reportedly said the unauthorised access occurred through the Stockal interface and attributed responsibility for associated security lapses to Stockal. It reportedly said it froze the account on Stockal’s instructions.

Responding to Inc42’s questions, DriveWealth said, “The Stockal incident is unrelated to DriveWealth’s systems. It occurred on Stockal’s app, not our platform. DriveWealth does not have a customer-facing app through which trades are placed, and our systems and client data were not affected by this incident.” 

Borderless’s public statement offered a possible explanation – social engineering involving information exposed in another company’s data breach several weeks earlier. It stressed that this connection remained unverified and under investigation.

Borderless said its investigation found no evidence of a breach or compromise of its platform, interface, infrastructure, or internal systems. It also said no funds were withdrawn from affected accounts, based on findings available so far.

This distinction leaves the disputed trades themselves central to investors’ concerns – their allegation concerns changes to their holdings without consent, irrespective of whether money left the accounts.

Safeguards Under The Spotlight

The precise access method remains under investigation. However, the incident raises questions about whether possession of valid credentials could have been sufficient to execute the disputed trades.

Yash Kadakia, founder and CTO of cybersecurity firm Security Brigade, told Inc42 that stolen credentials are a common entry point, but platforms cannot shift responsibility entirely to customers when compromised passwords enable financial transactions.

He said layered safeguards should include two-factor authentication, SIM binding, device and geographical checks, and separate transaction-level authentication.

Behavioural monitoring is also critical. Multiple accounts accessed from one IP address, or similar trading patterns across accounts within a short period, should trigger scrutiny, he said.

Such monitoring could explain DriveWealth’s detection of suspicious activity, Kadakia suggested, although the actual detection mechanism remains unclear.

He added that implementation and enforcement remain challenges despite stronger SEBI cybersecurity requirements for regulated entities.

Borderless Sets Out Its Position

Borderless said it had engaged independent cybersecurity specialists, introduced additional authentication and account-protection measures, and found no evidence of a wider threat to its platform, products, or other customer accounts.

It maintained that unauthorised trading identified so far was restricted to 13 accounts.

The company said it had been engaging affected customers and working with DriveWealth to reconstruct events, examine disputed transactions, and explore avenues for a fair resolution. However, it said assistance should not be construed as an admission of liability, negligence, wrongdoing, or responsibility. It said it was cooperating with authorities and regulators.

Borderless also maintained it had provided substantive responses to media enquiries before publication and cautioned that its public account could change as the investigation progressed.

Inc42 has separately sought answers on the transactions, investigation, and investor concerns. The story will be updated upon receiving a response.

Who Bears The Responsibility?

The controversy has also drawn attention to Stockal’s former partnership with HDFC Securities. Launched in 2019 through globalinvesting.in, their operational association ended in July 2024.

HDFC Securities has clarified that it is not named among the accused in the FIR and said it would cooperate with regulators and law enforcement authorities.

While HDFC Securities has clarified its position, questions about the disputed trades remain unresolved. How were the accounts accessed, why were the transactions not intercepted, and what recourse do affected investors have to restore their holdings or recover losses?

Cross-border investing divides responsibilities across the customer interface, trade execution, and custody of securities. Establishing each intermediary’s obligations and the safeguards applied will be central to determining accountability.

For affected investors, the immediate issue remains whether the investigation will explain the disputed trades and deliver a resolution. For now, neither the source of the alleged compromise nor responsibility for the claimed losses has been conclusively established.

Edited by Vinaykumar Rai

The post Stockal’s US Trading Row: Missing Consent, A Chinese Microcap, And Unanswered Questions appeared first on Inc42 Media.