My friend had $5,000 worth of Bitcoins in a Blockchain.info online wallet, which was backed up by two very strong passwords (One for login, and the other for transaction). Email confirmation was also enabled. But somehow, the thieves managed to steal all the coins two months ago. Till now, we don't know how the passwords were cracked, but incidents such as this one scares a lot of potential Bitcoin users.
There are many scam accusations to blockchain wallets recenlty,
I noticed also that blockchain wallet is removed from the bitcon.org (https://bitcoin.org/en/choose-your-wallet)
There should be no more trust to this website to use it as a wallet, your friend's story is terrible and should take that as a lesson for us.