PayPal are blaming Paxos, and Paxos are releasing the usual boilerplate "Funds are safu" nonsense while reportedly contracting F2Pool to get their money back.
Just another data point to add the the hundreds of thousands of data points showing that no matter how big, how well know, how "reputable" any centralized exchange is, they cannot be trusted to use even basic security protocols.