Quote from: NeuroticFish on Today at 11:55:38 AM

Quote from: IDDEX on Today at 10:46:27 AM

He told me that he may attempt to send bitcoin the day before or the same day but not sending the full 50 BTC

This is something useful. This may indeed mean that your friend's money may not be stolen, although it again doesn't add up, since if he would have sent smaller amount, the transaction would have been looking different.
That transaction looks like either a consolidation of funds, or seep (as nc50lc said!), either a hack. And in the previous or next few days there were no transactions from that address.

It's quite sad that you are asking here this late; back those days your friend could have been more certain about what he did, hence be more helpful for tracking the funds.

However, if it's not a hack (I'm not 100% convinced, but let's get more optimistic, at least.) then it's a consolidation or sweep.

Although I didn't follow those, I remember some stories (I don't know how real) about sweeping a paper wallet that ended into disaster, funds being sent to odd/unknown addresses.
Again, I don't know those well, but maybe it rings a bell to somebody familiar with the topic.

First I'd try to see though what other addresses are in that wallet, since there are more transactions going to 1EF3DDBaPzbpJ5cXHVW2gZkyG1Jd4FotFW and they look intended, while the change goes back to 13uzBESjqTT87ak4uAipKUoP8EuVHcQk2e.

Thank your for your comment