Had the exact same happen to a relative of mine. Their API key was compromised, Express Account were added with a bank account in Greece rather than the existin

Had the exact same happen to a relative of mine. Their API key was compromised, Express Account were added with a bank account in Greece rather than the existing in France, these account didn't require any verification unlike accounts he added in the past, existing credits cards were billed hundreds of thousands when the entire account had not even half of that over years. Overall it's his fault for not properly securing the API key, but Stripe should have suspended the account when over 90% of the payments were failed charges and money was being moved to another country.