Stockal’s US Trading Row: Missing Consent, A Chinese Microcap, And Unanswered Questions

Nearly 30 Indian investors say their Stockal portfolios were altered without permission on October 15. Established US shares were allegedly liquidated, and the proceeds were used to purchase Zhibao Technology, a thinly traded Chinese microcap listed on Nasdaq. The incident matters because investors lost control of holdings they had chosen and were left with a far less liquid security.

The reported trades happened quickly. One investor said securities worth $3.1 Mn, around ₹29 Cr, were sold within two minutes. About 30.5 Lakh Zhibao shares were bought within the next 15 minutes. Another investor reported sales of $335,768 followed by purchases of 3 Lakh Zhibao shares.

Borderless said DriveWealth alerted it to suspicious trading across 13 accounts. Its assessment indicated that 26 accounts were accessed using valid credentials, while 13 had large-cap shares sold for microcap purchases. The access method and responsibility remain under investigation.

A thinly traded microcap is a stock from a small company that changes hands relatively infrequently. Limited trading can make it harder to buy or sell sizable positions at a predictable price. The article describes Zhibao Technology as a thinly traded Chinese microcap listed on Nasdaq, unlike the large, established companies investors originally held.

That difference creates particular risk when a portfolio is changed without consent. The article reports that holdings including Alphabet and AMD were replaced with Zhibao shares. Investor accounts cited an average purchase price of around $1.05. Zhibao later closed at $0.42 on October 23, a decline of approximately 60%.

The article does not claim that thin trading alone caused every loss. It shows that investors were exposed to a security with a different risk profile and then saw its price fall sharply. The alleged forced replacement, rather than an informed investment choice, is central to the dispute.

The reported scale spans both account activity and investor complaints. Nearly 30 investors allegedly said their portfolios were changed without consent. Borderless said its assessment found that an unauthorised third party accessed 26 accounts using valid login credentials, with suspicious trading identified across 13 accounts.

The individual transactions were large and unusually fast. One investor told Moneycontrol that securities worth $3.1 Mn, or around ₹29 Cr, were sold within two minutes. The account then bought 30.5 Lakh Zhibao shares within 15 minutes. Another investor reported that $335,768 in holdings were sold and 3 Lakh Zhibao shares purchased.

Media reports put investor-reported losses above ₹100 Cr. Inc42 said it had not independently verified that aggregate or authenticated the account details and alleged transactions. An FIR has reportedly been registered in Bengaluru, while the access method and responsibility remain disputed.

After the alleged trades, Zhibao Technology’s price moved sharply lower. Investor accounts cited an average purchase price of around $1.05. The shares closed at $0.42 on October 23, representing a fall of approximately 60% from that reported average.

This decline deepened the damage because investors allegedly began with established US holdings and ended up owning Zhibao shares. Their losses therefore reflected both the disputed sale of their original investments and the fall in the replacement stock. The article gives no final verified loss figure for every affected investor.

The reported price movement also increased the urgency of the dispute. Borderless said it restricted access after DriveWealth notified it of suspicious trading. Investors’ concerns remain focused on how the accounts were accessed, whether safeguards failed, and which party bears responsibility for the unauthorised transactions.

Stockal, founded in 2016, enables Indians to invest overseas through US stocks, exchange-traded funds, and curated portfolios. Borderless Investing is identified as Stockal’s parent. The company partners with DriveWealth, a US brokerage, to facilitate US stock investments for its customers.

The companies describe the incident differently. DriveWealth reportedly said unauthorised access occurred through the Stockal interface and attributed related security lapses to Stockal. DriveWealth also said it does not have a customer-facing app for placing trades and that its systems and client data were not affected.

Borderless said its investigation found no evidence that its platform, interface, infrastructure, or internal systems had been breached. It said DriveWealth notified it of suspicious trading across 13 accounts and that access was restricted shortly afterward. Responsibility remains disputed across the interface, parent company, and brokerage relationship.

If someone obtains valid login credentials, a platform may treat the person as an authorised user unless additional checks intervene. The article says Borderless’s assessment indicated that an unauthorised third party accessed 26 accounts using valid credentials. It does not establish how those credentials were obtained or exactly how trades were placed.

Cybersecurity expert Yash Kadakia said safeguards should include two-factor authentication, SIM binding, device and geographical checks, and separate transaction-level authentication. Behavioural monitoring could also flag multiple accounts accessed from one IP address or similar trades placed across accounts within minutes. Those signals might have prompted earlier review or blocked the activity.

Borderless mentioned possible social engineering involving information exposed in another company’s data breach, but stressed that this link was unverified. It said no breach of its own systems had been found. The incident therefore leaves open whether password access bypassed sufficient controls and whether stronger checks could have limited the trades.

A brokerage app is the customer-facing layer where an investor selects a security, quantity, and order instruction. The connected brokerage then receives that instruction, processes it, and executes the securities trade. In this case, Stockal provides the investing interface and DriveWealth is the brokerage partner facilitating US stock investments.

The alleged sequence shows why each step matters. Investors say established holdings were sold, with proceeds used to buy Zhibao shares. One account reportedly sold $3.1 Mn of securities within two minutes and bought 30.5 Lakh Zhibao shares within 15 minutes. Those actions changed both ownership and investment risk.

Customer consent is central because the trades affect assets held for that customer. Borderless said no funds were withdrawn, but investors’ complaint concerns unauthorised changes to their holdings. The article does not provide the full technical order-routing process, so responsibility for each step remains disputed and under investigation.