Thanks for the input guys and sorry for posting in the wrong section.
If the BTC's are still there, move them asap to a much secure wallet and probably you will be the only one who knows. Crypto is money and the personal interest of other people with other's fund is there.
Yea i directly moved all BTC to a secure wallet.
I dont think it was a phishing site since there was no reason for a transfer on that day. He saved the right MEW link on chrome.
Even tho it would be a phishing site, he still need to confirm the transaction on Trezor which he didn't(thats what he says).
multis wallet/ contract are def. something for the future. I actually didn't expect that someone can steal money from a cold wallet tbh.
This is also the reason why i think my friend didn't steal the money because it would be a very stupid scam tho.We share a lotto friends and even the amount was big, i think not big enough to risk a lot friendship and be marked as a scammer