Just a heads up, if he's staking the Ethereum directly then the money is still safe. The Ethereum team hasn't implemented staking withdraws yet, which should happen this year: https://ethereum.org/en/staking/