If you have Find My Device (formerly Android Device Manger) enabled and the phone is on and has an internet connection then yes, you can remotely located, lock or wipe the phone. Otherwise unless you have installed a security app of your own and set it up there's nothing you can do.
(Actually I don't know whether changing your FB password would be enough to protect access from a device that's already logged on, but it might be worth considering. If you got a new SIM from your carrier and got them to assign your number to it then used that to sign in to WhatsApp from another phone I suspect that might disconnect your current one from WhatsApp. Possibly just getting it disconnected from the phone service by reporting it lost/stolen would do that, since your WhatsApp account is linked to your phone number - not certain here, just speculating. Reporting it stolen will also get the IMEI blacklisted - perfect unless you get it back somehow!).
As for hacking the PIN, how clean was the screen? If someone can see where you tapped it it greatly reduces the number of combinations they need to try. Many phones will require some other id, such as your Google login, after some number of failed PIN attempts, while some will do a reset if they get it wrong too often. I don't know what this model will do.
