He downloaded a bad app or gave his keys (unknowingly) to a web service. Or his other machines which he likely used to trade were compromised. Its his fault, there's no vulnerability.