Hacked profile

My friend got hacked and he has no clue how.
He has the 2 step verification by phone number, we don't know how to report that and how to make sure it doesn't happen again, can anyone help?
Also, is there any way to get his stuff back?

 

can he manually change the token so the hacker has no longer access to his account or is that not possible?

 

If you mean your minecraft accounts been hacked then you'll need to contact Microsoft support. They can help you try to recover the account, don't go sharing your 2fa or 6 digit codes with players as that's how accounts can be lost. I hope you can recover the accounts.

This may help you, from the Microsoft support pages and contact links for support.
How to recover a hacked or compromised Microsoft account - Microsoft Support