According to the cointelegraph article. linked by Lanatsa [ DO NOT POST SESC LINKS ]above[/url]:
https://cointelegraph.com/news/paxos-confirms-responsible-for-500k-mistaken-bitcoin-transaction it was not PayPal (as many initially thought) but Paxos, who (allegedly) admitted to CoinTelegraph that the mistake was their own.