The article calls out to a Reddit post [0] in which OP admits that their app code or environment has been compromised and doubles down on stripe in it.
Had the exact same happen to a relative of mine. Their API key was compromised, Express Account were added with a bank account in Greece rather than the existing in France, these account didn't require any verification unlike accounts he added in the past, existing credits cards were billed hundreds of thousands when the entire account had not even half of that over years. Overall it's his fault for not properly securing the API key, but Stripe should have suspended the account when over 90% of the payments were failed charges and money was being moved to another country.
This sucks man. I hope you get the money back. Have you tried tweeting at @patrickc (https://x.com/patrickc) just to get more eyes on it