Nothing. He can't do anything. He lost his tokens and won't be able to get it back (unless the hacker feels bad and returns it to him which I doubt will ever happen). One thing he can do is to know how he got hacked. I bet he stored his tokens in an online wallet or an exchange. Or maybe in a computer that's infected. Let this be a lesson to him. Tell him to learn from here and in the future to make sure all his accounts and wallets where he stores his tokens/coins are secured and safe.
Not worth regretting about it. Tell him to move on and start all over agai.