sure he can't restore his coin
so how can protect offline wallet ?
Your friend must not send his private key to anyone via social media, or store it anywhere. They should have written it down on a piece of paper and stash it somewhere where no one would find it, at best. Other than that, treat the offline wallet as an offline wallet, meaning don't have it connected to the internet-enabled computer any longer than it needs to be connected for coin transfers to take place. Other than that, try not to lose it or have it stolen, and all should be well. As for restoring the coins, if they were stolen from the wallet, meaning sent to another address in a transaction done by a third party, those coins are gone. Crypto transactions are irreversible.