[TimothyFarrar]

Moses,

My guess is that it isn't just a simple dictionary hack. Paypal doesn't have a fast enough response rate for someone to sit and try passwords all day long using some kind of automated tool. Also I'm nearly positive that this activity would get flagged and a sysadmin at paypal would see it and disable the account.

If you are sure you didn't somehow get phished, ie you always manually type in the URL to paypal in the browser, then something more serious happened. Other phishing / social engineering methods are fake emails with call back numbers. So people think they are safe by not using the URL in the email and instead call the phone number in the email...

Serious as in they got your paypal password directly because some computer which you use to log into paypal is compromised. If you use a PC then this is highly likely. If it was a dictionary hack then it probably was done on some password file instead of directly trying to log into your paypal account.

If your paypal account was compromised then they probably have access to the bank account or credit card attached to the paypal account. Also if one of your computers was compromised then they would also have access to many other things.

My advice is to change everything and act as your "wallet" was taken. Better to be safe then sorry.