Your friend was not hacked, but his gadgets have been infected by a clipboard virus. From the txid you provided, I searched for the address, and I came across 19p4Va5RjrrXeLpSPCcKLPALQxgSoP6i8g, which was where your expected payment was sent to, and if I’m correct, then that address has been reported to be associated with phishing scams, clipboard virus scams, and all manner of fraud online. You sent the right address to your friend, but upon copying and pasting it, the wallet changed to the scammer's address, which he was not vigilant enough to notice.

https://www.bitcoinwhoswho.com/address/19p4Va5RjrrXeLpSPCcKLPALQxgSoP6i8g