UPDATE: A PayPal spokesperson says its infrastructure partner Paxos was responsible for the overpayment:

"This only impacted Paxos corporate operations. Paxos clients and end users have not been affected and all customer funds are safe."