They can go public, which is what they've done here and on Twitter.
After that, they have to consider legal action, and it won't be cheap.
PayPal should be forced to pay back legal fees when they lose..
Except financial companies are given civil immunity for this kind of thing if they file a SAR. It's effectively a license to steal. And I suspect it has less to do with any actual crime and more to do with the fact that some of the team is Russian.