Isn't what they are doing illegal?

If so, they should leave a lot of traces behind: paypal, bitpay, hosting, credit card and bank transfers.
What could you do against them?