Hi Otoh and thanks cygan for let me know about this Topic and Thread.

First at all i just did a quick overview of your mentioned Addresses.

The Scammer Address bc1qun3ue8c5j4qgs72qefs9szsngs6ledu83f048z was only Created on the 26.02.2025 23:26 and the Latest activity was on 03.03.2025 18:13
Source : https://tokenscope.com/en/address/bc1qun3ue8c5j4qgs72qefs9szsngs6ledu83f048z/btc/btc

Just to show whats going on and how many other Addresses involved in that whole thing look at this:
From my experience of the last years and that cases i have done some research i would say its an Exchange or Bitcoin Service you can use:
The Orange Marked arrow on the Picture is the first Address where the funds got moved from the Scammers.

Source : https://explorer.bitquery.io/bitcoin/address/bc1qun3ue8c5j4qgs72qefs9szsngs6ledu83f048z/graph  Settings here are Outbound 4 and specially for the Address bc1qlddfc5psmhfp4z6ckzwp7nhxrwsa7dfp8gz383

There are already some more Addresses involved in that Scam and what i can i can see from the Scammer Address.

So i would say that its a well organized group of scammers with more members or an direct attemp to scam your Friend.
That things that i found was just an normal research and nothing speciall i was looking on it.
If i have the time i will be looking more into that over the weekend and next Week.
Its all a bit more time intensiv as most of all know and it takes some time.

I know that this is not the big news that you would be hear and bring the funds back , but i will be looking at it and keep you up to date.
Regards Lafu