It seems like your friend got trapped by phishing or his wallet already hijacked by the scammer. That means the wallet that you have mentioned above is scammer's wallet.
You should ask your friend whether he was dealing with suspicious link, website or something else. i thought that someone knows his privatekey or a key to enter into his wallet.
The scammers were sending all of his money.