how does it happen? which wallet your friend used?. If wallet exchange you can contact exchange support. if non-custodial wallet nothing to do, this means the hacker owns your friend private key, you can't take it back 3000 waves, you have to contact the local police.
He restored his account with his seed online.
He probably used a fake side.
At the same day someone canceled the leasing sold his 3k waves in btc and send the btc to the address...
Thank you
Seems your friend opened a phishing site. I don't click links when visiting websites, I would rather type the whole address and even bookmark websites I often visit for my own security. There is nothing else you can do even if you report it to the authorities. Charge it to experience and learn from it.