Your comment implicitly absolves PayPal of responsibility.
One thief sold to another , it is like credit card lists or botnets are sold on the dark web .
PayPal is hardly innocent here , they knew what they were getting into , this is the core business model of not just honey but all of the coupon sites.
