Nearly 30 Indian retail investors have alleged losses exceeding ₹100 crore after unauthorised trades on Bengaluru-based wealthtech platform Stockal Securities emptied US blue-chip holdings into a thinly traded microcap. The disputed activity ran during US market hours on 15 October 2026; Stockal’s parent Borderless Investing and US custody partner DriveWealth LLC both deny liability, leaving investors chasing answers from SEBI, the US SEC and Bengaluru police.
Stockal Securities is a SEBI-registered Indian fintech that lets retail clients buy US stocks, ETFs and other foreign securities via an India-facing app, while DriveWealth executes trades and holds assets. It lands as more Indians open US equity exposure via domestic platforms, raising intermediary-risk questions when an Indian app sits ahead of an overseas broker.
What investors say happened on 15 October
Per complaints reported by Moneycontrol and NDTV Profit, accounts were accessed without the holders’ consent. Borderless said an unauthorised third party used valid login credentials on 26 customer accounts. In 13, large-cap US equity holdings were sold and the proceeds used to buy thinly traded microcap securities. “Based on our investigation to date, no funds were withdrawn,” Borderless said.
One senior corporate official told Moneycontrol ten major US names—including Apple, Tesla, Amazon, Alphabet, Nvidia and AMD—were liquidated for about $335,768 and swapped into 300,000 shares of Chinese US-listed Zhibao Technology Inc. (NASDAQ: ZBAO) at an average $1.05. ZBAO then fell nearly 60% to $0.42 by 23 October (about ₹4.26 crore for that investor). Another investor said about $3.1 million (around ₹29 crore) of securities were sold without authorisation. The ₹100 crore-plus figure is preliminary; totals could be higher.
Borderless and DriveWealth dispute responsibility
In a 4 November 2026 statement, Borderless denied liability, wrongdoing, negligence or responsibility. It said DriveWealth flagged unauthorised trading in 13 accounts on 16 October India time (15 October US hours), after which access was restricted. Borderless said it found no evidence of a platform breach and suggested possible social engineering or phishing tied to another company’s earlier data breach—a link it said remained unconfirmed. It engaged independent cybersecurity specialists and added extra authentication as a precaution.
DriveWealth told Moneycontrol on 5 November 2026 that the incident was “unrelated to DriveWealth, as it occurred on Stockal’s app, not our platform,” adding that it has no customer-facing trading app and that its systems and client data were unaffected. A 30 October letter to one investor had already argued access occurred in the Stockal interface. The standoff echoes a broader push for stronger controls, from cybersecurity as a broking differentiator to programmes such as SBI’s CyRIS cyber resilience centre.
FIR, SEBI and SEC complaints
At least one investor registered a First Information Report in Bengaluru naming DriveWealth LLC, Stockal Securities, Borderless Softech Private Limited, Borderless Investing Inc. and HDFC Securities. HDFC Securities has not been named as an accused; its operational partnership with Stockal ended in July 2024. Investors have also approached SEBI and the US SEC. For overseas-route context, see Elets Banking and Finance’s guide to US stock investment apps available in India and the NPCI–IIIT Hyderabad cybersecurity MoU.
Why it matters for India wealthtech
Cross-border retail brokerage splits the Indian app experience from US execution and custody. When credentials appear valid yet trades are contested, investors face delays over who must restore positions, freeze illicit holdings or compensate losses—and which regulator can compel action. Until Borderless and DriveWealth resolve that standoff, Stockal is a live stress test of intermediary accountability in India’s US-stocks wealthtech boom.
Key takeaways
- Nearly 30 Stockal investors allege unauthorised US-stock liquidations on 15 October 2026, with preliminary losses above ₹100 crore; Borderless says 26 accounts were accessed with valid credentials and 13 saw large-caps swapped into microcaps such as ZBAO.
- Borderless denies a platform breach and points to possible phishing; DriveWealth says the activity happened on Stockal’s app and its systems were unaffected.
- Investors have filed a Bengaluru FIR and SEBI/SEC complaints, highlighting custody and liability gaps when Indian wealthtech apps route to overseas brokers.
Frequently asked questions
Did Stockal say its systems were hacked?
No. Borderless said it found no evidence of a platform breach and that access appeared to use valid credentials, possibly obtained through phishing or social engineering.
What is DriveWealth’s role?
DriveWealth is Stockal’s US brokerage and custody partner. It says it has no customer-facing trading app and that the unauthorised activity occurred on Stockal’s interface, not its systems.
How large are the alleged losses?
Reporters cite a preliminary figure above ₹100 crore; individual cases include roughly ₹4.26 crore and about $3.1 million of securities sold without authorisation. Totals may rise as more accounts are reviewed.
Featured image: Nasdaq MarketSite, Times Square, New York. Photo: ajay_suresh via Wikimedia Commons (CC BY 2.0)
