- On October 15, US stock holdings in multiple accounts were sold without authorization, with proceeds used to buy Zhibao Technology shares worth approximately ₹3.19 crore.
- On October 16, adjustments transferred the 3 lakh Zhibao shares from the investor's account to an internal account, with further entries recording original securities as credited back and then sold again.
- On October 27, Stockal stated that valid login credentials were used and no breach was found, while investigating why the investor did not receive transaction alerts.
- On October 30, DriveWealth disclosed that unauthorized access occurred through Stockal's interface, placing responsibility on Stockal for the security lapses.
- On November 4, Borderless Investing denied liability, stating that 26 accounts were accessed using valid credentials, with 13 accounts experiencing asset swaps.
- An FIR was registered in Bengaluru against DriveWealth, Stockal Securities, Borderless entities, and HDFC Securities regarding the unauthorized transactions.
- DriveWealth disclosed unauthorized access to its network on September 4-5, during which personal information was exfiltrated, affecting investors including those using Stockal.
- Borderless Investing stated that a possible social-engineering attack may have involved information exposed in another company's data breach, but this connection remains unconfirmed.
Stockal, a Bengaluru-based fintech platform, is embroiled in controversy as nearly 30 investors allege unauthorized sales of their US stock portfolios, including shares of Apple and Nvidia, totaling approximately ₹3.19 crore. The proceeds were reportedly redirected to purchase 300,000 shares of Zhibao Technology, a thinly traded Chinese company.
On October 15, one investor's holdings were liquidated for gross proceeds of $335,768.08, which were then used to buy Zhibao shares at an average price of $1.05 per share. The investor estimated losses at around ₹4.26 crore ($450,000). Another investor claimed that $3.1 million worth of securities were sold within two minutes, followed by the purchase of 30.5 lakh shares of a microcap stock.
In response, Stockal stated that valid login credentials were used and that they found no evidence of a breach on their platform. They are investigating why the investor did not receive transaction alerts. The parent company, Borderless Investing, also denied liability, attributing the unauthorized access to a possible social-engineering attack.8
The incident has prompted complaints to market regulators in both India and the US, with affected investors seeking intervention and compensation. An FIR has been registered in Bengaluru against multiple entities, including DriveWealth and HDFC Securities.67
“Affected investor reported 10 holdings, including 150 Apple and 400 Nvidia shares, sold for $335,768 on October 15; funds bought 3 lakh Zhibao shares. Borderless says 26 accounts accessed with valid credentials, 13 saw asset swaps, and no funds were withdrawn.”
