We would have heard for sure if this was a massve hacking issue, there could be many factors leading to your friends issue, often there will be phishing emails sent to try and trick users into clicking and entering thie login details.

What did Bittrex have to say on this matter? did your friend contact their support?