I can't believe in this story, we need some proof.
If you have 2FA, you need the device to get the pass code that changes every 30 seconds or the hacker is like god and can bypass it.
In bittrex, if you acess from differente IP, you need to confirm via email, so hacker need to hack your email too.
Not impossible but its very hard to get something like this.
I think your friend doesn't have 2FA, only email alert, so if his password compromised he got hacked.
I'm leaning toward your opinion. The odds of hacking IP based email verification is hard enough, let alone 2 part logins. It sounds more like the people losing their coins have a security issue on their end rather than on Bittrex.
I sure hope this is the case. I don't want to wake up one morning to a Nicehash scenario, where there may not have actually been a hack and could have been an outright theft. <<
Any exchange/pool/wallet is only as safe as the coders are honest. This is why I have abandoned JAXX, opting for Exodus.
Gotta be very careful especially at the levels the markets are at.