Hey again!
Got some news, kinda good. Convinced my buddy it's definitely a scam. It was Difficult, because he dropped 3K$ and got back 3,300$, so he's still skeptical. Not sure if the scammers will be satisfied with 300 bucks in the victim's account. We'll see.
About sharing that domain some of you asked about, I've got reservations. Let me break it down.
The domain is the name of a somewhat known exchange/wallet plus some random characters and .com.
Not spilling it here 'cause, like I said earlier, it doesn't show up in any Google search or social media. I suspect it's a custom-made domain for this scam, so they can easily find threads like this one and check if the victim's onto them.
I think it's reason enough not to disclose it. I'll continue to provide updates as things go on. If everything finish without major issues, I'll share the domain, but I want to ensure my mate is out of danger first.
Anyway, thanks once again for all the responses!