Sort:  

I did not use a service. We merely synced the ETC chain with the Ethereum based wallet. Then imported my private key and transfered the ETC to my Bittrex account? We moved a small amount first, then when we were sure the ETC was was in the Bittrex wallet, we moved the rest. I unfortunately was under the impression it was that simple and not aware of the replay attacks. The link to the hackers wallet is listed above. You'll see he is still taking coins and converting some of them to DGD tokens. http://etherscan.io/address/0xfbb1b73c4f0bda4f67dca266ce6ef42f520fbb98.
I am certain my friend is not a this hacker and very sure it was a replay attack.

I don't understand then how the hacker got your coins. If your transactions played on both chains, they would have transferred the coins to precisely the same account on both chains.

It was the same account on both chains. As the the coins transferred to my Bittrex account 0x4f7144b02273bdc4083b98ea075a5ab13fa9d4dd the transaction was replayed on the ETH chain. Have a look http://etherscan.io/address/0x4f7144b02273bdc4083b98ea075a5ab13fa9d4dd. As to how they got the coins out of that mirror account on ETH I have no idea. The must have found a way to create an ETH account for a specific address or something.

Only Bittrex could have transferred those funds. Only they had the key to the account. (Unless something much weirder is going on.)