Anyway, you don't have a lot of options, right now.
You can throw the IP out for investigation in the deep net, if you have any contact there.
Or you can wait for monday, regain access to your account, and depending on the damage, decide wether it's worth trying to file a complaint or not.
Oh, and before you receive your yubikey, at least go for google auth, as it will stop most script kiddies brutally.