Does the wallet is hardwallet? if so then it can't be hack just like that it has a private key I conclude that while he's chatting I think I trusted that person that he gave his password or the private key itself that's a hypothesis number one the two is that your friend account on messenger got hack and I think the saved passwords and private key are there. There are many ways to have wallet got hack but its not on the wallet, but nevertheless let me gave you a tip that you should be careful on whom you trusted and always be wise.