The successful heist of 25,000 bitcoins undermines the whole bitcoin project. It behoves (sorry about the antique word, I'm an old guy) the movers and shakers in the bitcoin world to solve it, quickly.
How I see it: To really help this guy would need a lot of detailed information, not only technical but personal. So I will make some assumptions and based on these suggest a way forward.
He is young, technically savvy, got in very early to buy 25,000 at a good price. When it peeked briefly at $30 he was theoretically worth $750,000 which is intoxicating and almost impossible to keep quiet about. Perhaps he told someone he shouldn't have. A fellow student, co-worker, family even, someone who could discover his passwords without having to hack anything. $750,000 is a substantial sum and could, apparently did, inspire serious felony. Such a large sum should be kept in a safe, in this case meaning a dedicated computer which would not be connected to the internet except when actually necessary to do so to trade. As soon as the trade is completed, log off and physically disconnect. All preliminary and follow-up correspondence would be done from another box.
What to do? He needs to hire a very highly skilled investigator, not only technical but also an old-fashioned detective. This will cost a bundle which, I assume, he hasn't got. So offer a reward. It would have to be substantial to get the calibre of man needed to solve this case. Probably about one third or more of the amount stolen, say 10,000 bitcoins. A lot of money to lose, but better than losing the whole lot.
And, when it all shakes out, please let us know whodunnit and howdunnit so we can all make the bitcoin saga safer.