From a reddit thread about it, someone mentioned he was using a blockchain.com wallet so they probably got his phone and reset his password with 2FA and took the funds