Nearly 30 Indian investors utilizing Stockal’s platform for US stock investments discovered their portfolios altered without consent on October 15, 2026. High-value holdings in companies like Apple, Amazon, Tesla, and NVIDIA were reportedly sold and replaced by shares of Nasdaq-listed Zhibao Technology, sparking significant financial losses and legal scrutiny.
- Over $3 million in US stocks allegedly sold without investor approval.
- Purchases of highly volatile Chinese microcap Zhibao Technology followed.
- Investigations focus on account access and security lapses across involved firms.
What happened
On October 15, 2026, multiple investors using Stockal, an Indian platform enabling US stock investments, found their portfolios dramatically altered without their consent. Stocks of major corporations including Apple, Amazon, Tesla, NVIDIA, Alphabet, and AMD were reportedly liquidated and replaced by large volumes of shares in Zhibao Technology, a thinly traded Chinese microcap. Investors reported rapid transaction sequences where millions of dollars worth of established stocks were sold and replaced in mere minutes.
The price of Zhibao shares plummeted about 60% within days following these transactions, intensifying reported investor losses. The suspicious activity prompted at least one FIR to be filed in Bengaluru and has drawn considerable media and regulatory attention. The incident centers around how accounts were accessed and who holds responsibility for the breach across Stockal, its parent company Borderless Investing, and US brokerage DriveWealth.
Why it matters
Stockal, founded in 2016 and backed by investors such as ScaleX Partners and HDFC Securities, offers Indian investors streamlined access to US equities through a partnership with DriveWealth. The incident highlights vulnerabilities in cross-border retail investing platforms, specifically regarding authentication, account security, and risk management when handling high-net-worth client portfolios remotely.
Both Borderless and DriveWealth have denied compromise of their core platforms, attributing unauthorized trades to the use of valid but compromised credentials, possibly through external social engineering tied to prior data breaches. The case underscores the challenges fintech platforms face in safeguarding user assets against increasingly sophisticated cyber threats and highlights the need for stronger investor protections and regulatory oversight in India’s burgeoning overseas investment market.
What to watch next
Authorities in India are investigating the breach and unauthorized transactions to determine the exact sequence of events and legal liabilities. It will be critical to follow the outcomes related to whether the investors’ funds were withdrawn or merely the stock holdings altered, as well as potential regulatory action or enforcement against the involved parties.
Further scrutiny is expected on the collaboration model between Stockal, Borderless, and DriveWealth, particularly regarding security protocols, transaction monitoring, and consumer recourse mechanisms. Investors and regulators will also be watching for reforms or new industry standards to prevent similar incidents and enhance transparency in cross-border investment platforms.