Did you ask your friend if he clicks on somewhere maybe someone sent him an email? because I think he is a victim of Phishing and that could be the reason why his 3000waves came out from his wallet or maybe did he sent it to an exchange? that is not trusted because I read some posts in this thread that it might be an exchange address, contact the support of that exchange maybe he can get an answer to his questions.