I myself am no pro, am learning just like you.

To answer your question the hack was carried out via one of the various fake email-ids that I have and as soon as the payment was done the card information was removed from the PayPal account so that even if detected further amount of money can’t be deducted from the card. They can track it back to me no doubt, but according to their systems there is nothing wrong that should be tracked, for them the right amount of payment was carried out.