He reported the academic dishonesty (copies of figures from another paper presented as new experimental results), and the university went to great lengths to keep the whole thing quiet.
5 years later, the lead researcher who faked the results still works at the university, the paper has not been retracted, and my friend left what became a pretty hostile lab (and AFAIK is still under NDA)
At that point, what is left aside from trying to publicly remove your own name from a paper you know is fraudulent?