I don't know how to handle this case, I have two junior brothers in my small town who lives opposite to my house, one help the other to create a trust wallet and 100$ worth of Ethereum was deposited into the wallet, two days later the fund was moved out to am unknown address, after asking few questions from the wallet owner I found out that the other guy has access to the wallet too, I believe he did the dirty trick because he never warned the wallet owner to never share his recovery seed with anyone..if you are in my shoe what will you do..
You are in the dilemma here, but if I'm in your case, then it is better to take to the one that you suspected and confront him if ever he is the one who move the money or not. And just think that the money is gone now for sure because I doubt that who ever moved it out has the intention to bring it back.
So this is another expensive lessons, and to be honest, I can't imagine the 'brother' trying to scam the other one. So it's better to start all over again I guess. Perhaps he can start small, not necessarily $100, but maybe just $10 or at least what he can afford to invest but this time, he is now equipped with the knowledge that private keys and mnemonic phrase are very important and should not be disclosed even to his 'brother'.