how does it happen? which wallet your friend used?. If wallet exchange you can contact exchange support. if non-custodial wallet nothing to do, this means the hacker owns your friend private key, you can't take it back 3000 waves, you have to contact the local police.
He restored his account with his seed online.
He probably used a fake side.
At the same day someone canceled the leasing sold his 3k waves in btc and send the btc to the address...
Thank you