He restored his account with his seed online.
He probably used a fake side.
At the same day someone canceled the leasing sold his 3k waves in btc and send the btc to the address...
Thank you
Aw! Sorry with your friend's loss but there's nothing we can do with that. Your friend has to learn the lesson but that's a very expensive lesson.
It's impossible to recover it.
He didn't click a link in a email.
He didn't sent the waves to a wallet.
Everything looks like he logged in with his seed on a Phishing site, because he want to check the balance in his wallet. Everything was OK, but at the same day someone logged in and sold everything

Those phishers are online 24/7 when someone gets into their trap, they'll wipe your assets quickly.