Provide proof to paypal, then email the registrar and tell them to "freeze" the domain and reverse the transfer. Most likely, they will not do it. But if you can provide proof, they will. Most likely, they will ask you to file UDRP and when they receive court order, they will return the domain to you. You can also do this if you have a lawyer relative who do this for free.