Copy Paste Malware/Virus.
If you don't want to be a victim, just don't rush when payments/transactions are involve. Tbh, it should always be like that, right? ( well, for me it's a MUST). A minute or two would be enough to double/triple check the address/private key that we pasted.
I have seen so many people have been getting the same case as your friend. Basically your friend's PC has been affected by ransom ware that has copied the scammer's address to the clip board. You should remind your friend to keep update and never try to click on any suspicious link. It seems like your friend being trapped by scammer.
Ransomware is different, the malware encrypts your files and it will not be decrypted unless you pay a ransom to the address given. Friend of mine experienced it, but he didn't pay and decided to just reset the PC
(fortunately he has a back up of the files)