I know two exploits. One that I 'made' myself, and one that a friend found out about. One has a 99% success rate if you find the correct store.
the other one changes the payment url so that you only have to pay 0.01$ for the package. I'm not sure if that worked with buycraft though.
The one that I 'made' myself, is still working.
but is illegal.