Nonprofit Stripe ATO

Our email account and stripe account was hacked and before we knew what was happening over $20,000 was stolen from two donors in our system. The only way I found out was an email from one of the donors asking me why I charged her. By the time I checked the account it was locked down. I couldn't sign in so I did forgot password and I'd get a link but the system would ask me to authenticate. That authentification was going to someone else's authentification app. All emails regarding stripe were going into my "conversation history" so I was losing the emails and not knowing where they went. Finally, after a LONG time on chat with extremely non-helpful customer service people I was scheduled for a call the next morning. That person who called got me back into the account and we changed all the passwords, payout accounts, etc. She told me to refund the people who were charged. Then she said they'd reveiw it and get back to me. They have paused my payouts in the meantime. We now have more than $20,000 as a negative balance in the account. It has been over a week and the two donors have not yet been refunded. I can't get anyone to actually talk to me. I am terrified that our small nonprofit will be responsible for the payouts. I had no idea that Stripe takes no responsibility for fraud through their site. How can that be legal? I know, I signed the agreement where on page 60 it says I'm responsible. Why, if that is the case, don't they require us to use radar. I didn't even know what that was. Never in a million years did I think I could put my nonprofit at risk by using this hugely popular and well-known company's product to process donations. If anyone knows how to get this escalated... we can't fundraise at all right now because any money we take in just is locked up in Stripe.