First thing I'd do is log into my Roku account, scroll down, and look at the list of linked devices. Make sure they are all ones recognized as belonging there. You can unlink any unrecognized devices there.
While there, it would be a good idea to change your Roku account password, and change to a different email address if you have another you can use.
If it really was a hacker who had obtained your email and Roku password to get into your Roku account, he/she may also have obtained stolen cc info from someone else and used that.
Roku Community Streaming Expert
I am not a Roku employee, only a user like you. Please, no support questions via private message -- post them publicly to the Community where others may benefit as well.
If this post solves your problem please help others find this answer by clicking "Accept as Solution.".
Streaming Stick 4K+ 3821 | Streaming Stick+ 3810 | TCL Roku TV 43S245/C107X