Quote from: IDDEX on Today at 10:23:34 AM

To correct some information:

He didn't touch the phone the day before when he found his wallet had vanished. So it is clear that someone uses his private key. the moment when the coins moved his phone was OFF.

Even with that, it is still possible that he accidentally "sweep" the paper wallet's private key to another wallet.
4033ac94f79db922d327d82f154d686194ed54cded3b2221340484c09421e7bc had sent all of the available UTXO of that address that could mean that it was swept.
Sweeping it to another wallet is possible even without opening his Mycelium since it's the private key that's swept.

Quote from: IDDEX on Today at 10:23:34 AM

These transaction are done by my friend :
https://www.blockchain.com/btc/tx/b69ac4b06ce76e3144271e7017ad37aec8916bdc7cf77ac17541e075290a1120
https://www.blockchain.com/btc/tx/eac69ba4bc143a58908e68e3a2b8dc25704c9332923cb8a56b1eeeb33968a887

Those newer transaction's input was from a newly received transaction after that incident:

e8a181a2728d7034904b33881370bdf5405e73d7180b028211ed9b9b414fb9a1 - received 0.006 BTC
change of b69ac4b06ce76e3144271e7017ad37aec8916bdc7cf77ac17541e075290a1120 - 0.0050761 BTC

Plus, if it was stolen, it should be spent by now.

My guess is it's still in one of his forgotten wallet with "sweep private key" feature.
Or someone with access to his paper wallet had swept it to a watch-only wallet, so he can't spend it; or it's spendable but just waiting for something.