When your money is in PayPal's hands, it's technically theirs because they are not a financial institution. Your money is not insured or protected in any way other than how PayPal deems appropriate. They are not liable for anything, unlike a bank. So it's not only illegal at all (perhaps immoral but hey), it's also perfectly OK because _you_ agreed to their terms of use when you opened an account with them.