We would have heard for sure if this was a massve hacking issue, there could be many factors leading to your friends issue, often there will be phishing emails sent to try and trick users into clicking and entering thie login details.
What did Bittrex have to say on this matter? did your friend contact their support?
They didnt replied else, he had 2fa enebled. But now he think is bad he had saved code in mail. :-/
Look on this wallet which I sent there are two transactions, probably both from hacking.