Avoiding a scam?

TL;DR: I'm looking for some advice about how to talk my friend out of falling even further into a crypto scam.

This started with my friend "investing" $400 with this extremely shady sounding outfit that was promising impossible returns. I pointed out this was likely a scam, and they said "Oh, it's only $400. If it's a scam, all I can lose is $400." A few weeks later, their initial investment was doing impossibly well, gaining 3% per day... so they put in another $4000. -_-

At this point they have $22,000 in their investment account, in various coins, being traded by a robot. They can see their account, and see all the past trades, and see their current balance. They were thinking about putting in even more, so I encouraged them to first take some money out, to make sure this was a thing that was possible.

From here it's just gotten scammier and scammier, with the sales rep he's talking to telling him he doesn't want a customer who wants to withdraw money, or who asks about his operation online. But they agreed to cash out my friend and send him his money!

But first... he needs to create an account at a particular exchange and deposit $2200 to "establish himself on the blockchain."

At this point, I sent my friend to a reputable exchange, and said "Open an account here, don't deposit any money, figure out what kind of coin he wants to send you this in, send him your deposit address, receive the funds, withdraw the funds, close your account. They have no way of knowing if you have any funds in your account, don't deposit any funds."

My friend created his account, the scammer said they were going to send him USDC, the scammer told him he didn't need to actually buy any crypto, he just needed an account, with 10% of what was owed, beacuse it "made it easier for my bank". The scammer was also (worryingly) happy with the exchange I picked, so my friend opened an account there and (for some insane reason) deposited the 10% as cash. That's where things sit right now - account on an exchange, $2K in cash in it.

Now the scammer is saying he wants to pay my friend via a smart contract. So, already, there were like a bazillion alarm bells going off in my head, and this has just gotten so much worse. But - what is the scam at this point? How is the scammer going to get my friend to send him this $2K via an exchange? I've played around with Metamask and contracts a little but it's been a while... Can you even interact with a smart contract from an exchange? Don't you need a wallet and a private key to do that?

What do I tell my friend at this point? Ideally I'd like to say "This is what they're going to do, this is how they're going to try to scam you, so when you get to point X, this is when you know you should given up and just walk away." (I mean... if it were me, I'd have reached that point long ago.) This is depressing, because my friend is savvy enough they OUGHT to know better, but here we are...