Investors allege unauthorized portfolio liquidation on Stockal platform
Indian investors report that over $3 million in US stock holdings were liquidated without consent and moved into a single Chinese microcap, prompting an investigation into account security.
Nearly 30 investors have reported that their Stockal brokerage accounts were accessed by unauthorized parties on October 15, resulting in the unsanctioned sale of established holdings such as Apple, Amazon, and Tesla. According to claims, the proceeds were used to purchase shares of Zhibao Technology, a thinly traded Nasdaq-listed microcap that subsequently lost approximately 60% of its value.
While Stockal’s parent company, Borderless Investing, maintains that its internal systems were not compromised, it acknowledged that at least 26 accounts were accessed using valid credentials. Borderless suggested that the incident may have resulted from social engineering using information leaked in unrelated data breaches. US brokerage partner DriveWealth has denied responsibility, stating the issue occurred via the Stockal interface.
The incident has sparked a debate over cybersecurity standards for investment platforms. Experts note that even if attackers possess login credentials, platforms should maintain secondary safeguards, such as device binding or transaction-level authentication, to prevent unauthorized trading. An investigation is currently underway, and an FIR has been filed in Bengaluru.
Borderless Investing stated it is working to resolve the situation and has engaged independent cybersecurity experts to review its platform. The company maintains that no funds were withdrawn from the accounts, and has denied any admission of liability while cooperating with regulatory authorities.