Crypto transactions are irreversible and anonymous so there is no identity linked with crypto addresses so it is not possible to find who hacked the wallet, but it is important to find how he was hacked to save if there are any coins stored on the same device where the waves were stolen.

Ask him to scan his device with antivirus to find any malicious app or files which will be injected by hackers to steal funds via spam emails.