Legal ramifications depend on what your friend does about this. If he reports it (the theft) to the proper authorities she will be prosecuted. This will not replace the money lost nor the penalty paid on the early distribution. Your friend has to decide since the money is gone and will not be replaced whether he wants to report it. Certainly he should change the pin # immediately and I would keep all that information some place where she no longer has any access, even to the amount of money in the account.

What she did was illegal. The husband will eiher (a) talk with her about this and "work things out", or (b) he may is he so chooses bring a lwasuit against her for the money. The fact that they are married might complicate this a bit, but she still stole the money. If the marriage fails, he definitiely should sue her for the money. He would have to prove, however, that he didn't request the money.