Protecting Your Overseas Stock & Crypto Investments
Why we are writing ?
Two security incidents in October 2026 show that overseas investments can be lost through a stolen login, even when the market and the platform are working normally. If you hold US stocks or crypto, please take 15 minutes to go through the checklists below.
Ø Stockal (US stocks, 15 October 2026): About 30 Indian investors found their US blue-chip holdings (Apple, Nvidia, Amazon, Tesla and others) sold without their consent. The money was moved into a thinly traded Chinese stock that then fell about 60%. Reported losses exceed ₹100 crore, with one investor alleging $3.1 million (about ₹29 crore) sold from a single account.
Ø Binance (crypto, 29 October 2026): Hackers linked to North Korea moved about $6.3 billion out of the world's largest crypto exchange in roughly 20 minutes. Binance froze deposits and withdrawals and says it has fully compensated customers from its own reserves.
What went wrong ?
In both cases the attackers entered through a person's login or device, not by breaking the exchange itself.
Ø Stockal: The platform says its review points to stolen customer credentials or phishing. Its US custodian, DriveWealth, says the breach came through Stockal's interface and denies responsibility. Investors are now caught between the two.
Ø Binance: The attack began with a compromised engineer's laptop and was prepared at least 36 hours in advance.
Three lessons for investors:
1. You carry the platform risk. A large exchange can absorb a loss. A smaller platform, or one that blames the customer, may not pay you back.
2. Overseas investing has several layers. Usually an Indian app, a US broker or custodian, and sometimes an Indian broker that introduced you. When something goes wrong, each layer points to another.
3. Accounts that are rarely checked are the easiest targets. Large, long-held portfolios that are rarely opened let fraud go unnoticed for days.
Checklist: US and overseas stock accounts
Tick these off for every overseas investing app you use.
Ø Turn on app-based two-factor authentication (Google Authenticator or similar) instead of SMS OTP, where the platform supports it.
Ø Use a long, unique password for this account only, saved in a password manager.
Ø Make sure the registered email and mobile number are current and belong only to you.
Ø Turn on email and push alerts for every trade, login and change to your profile.
Ø Log in at least once a week and check your holdings against your last statement.
Ø Find out who your actual US broker or custodian is, and keep a copy of their statements, not just the app's dashboard.
Ø Disable or restrict trading if your platform offers a lock and you are a long-term holder.
Ø Log out of the app on shared or old devices, and keep your phone's software up to date.
Ø Keep your LRS remittance records and annual statements in one safe folder.
Why not just SMS OTP? Password plus SMS OTP is two-factor authentication, but it is the weakest kind. Fraudsters can get your OTP through a duplicate SIM (SIM swap), a fake website, a fake app that reads your SMS, or by simply asking you for it on a call. An authenticator app creates the code on your own phone, so a SIM swap or SMS malware can't capture it. If your platform only offers SMS OTP, it still protects you well, as long as you never share an OTP with anyone, read what each OTP is for before you use it, and report a sudden loss of mobile signal to your telecom operator at once.
Checklist: crypto holdings
Crypto has no investor-protection fund, so how you hold it matters as much as what you hold.
Ø Keep on an exchange only what you actively trade. Move long-term holdings to a hardware wallet you control.
Ø Store your wallet's recovery phrase offline ( master key), on paper or metal. Never photograph it, type it into a website, or share it.
Ø Use exchanges registered with India's FIU-IND ( Financial Intelligence Unit), and don't hold all your crypto on one exchange.
Ø Turn on withdrawal-address allow-listing and two-factor authentication on every exchange account.
Ø Don't hold crypto you may need on short notice. Exchanges can freeze withdrawals during an incident, as Binance did.
Ø Keep a record of every purchase, sale and transfer for tax filing.
Red flags
If any of these arrive, Pause,Think, Research / call us before you click.
Ø Emails or WhatsApp messages asking you to "update KYC", "renew your W-8BEN tax form" or "verify your account" through a link.
Ø A call claiming to be from your broker, SEBI, the SEC or a bank, asking for an OTP, password or screen share.
Ø Login or trade alerts you don't recognise. Act on these immediately, don't wait until later.
Ø Tips to buy an unknown foreign stock, especially through WhatsApp or Telegram groups.
Ø Recovery scams: after an incident like this, fraudsters pose as regulators, lawyers or "fund recovery" agents and ask for a fee to get your money back. No genuine regulator charges a fee to process a complaint.
If something goes wrong ?
Speed matters most. Do these in order, the same day.
1. Change your password and log out of all devices. Then ask the platform in writing to freeze trading and withdrawals.
2. Report it to the National Cyber Crime Helpline (call 1930) or cybercrime.gov.in, and file an FIR with your local police.
3. Lodge a complaint with SEBI through the SCORES portal. For US accounts, also complain to the US SEC and FINRA.
4. Save the evidence before anything is deleted:
o Trade confirmations and account statements, from both the app and the US custodian
o Login, OTP and alert emails or SMS, with dates and times
o Screenshots of your holdings before and after
o Bank and LRS remittance records
o All emails and chat messages with the platform
This advisory is for general information and for investor awareness only. It is not investment, legal or tax advice. Details of both incidents are based on media reports as of 4 November 2026 and may change as investigations continue.
Comments