Who did the tax collection? Did the exchange collect it automatically, or did your buddy do the filing? If the former, the exchange is sketchy; if the latter, your friend messed up.
If the exchange was overseas/super sketchy it's possible that the exchange just plain stole some of his money and claimed it was "for taxes."