Has your friend's wallet address previously interacted with Smart Contracts or 3rd party websites??
because as far as I use Mnemonic there are no problems with the altcoins that I have.
I've also lost assets of around 500 busd because I've interacted with smart contracts that are designed to drain the contents in your wallet when you interact with them.
even the case experienced is the same as what you are experiencing.
we can see quite a lot of fraud tokens in our wallets. so if we suddenly get a token that we don't know about and it turns out to be quite expensive. never expect it to be an airdrop. it will drain the tokens we have in the wallet.
However, about the fact that it was cracked into and money was stolen, I agree that some token situation, or some other way it was designed to get the owner participate a bit was involved, that way they could socially hack your cooperation and then get it directly from you.