A lot of people keep suggesting to go retain a lawyer immediately. There is something here that everyone seems to be overlooking though, this friend of his, if she is a criminal ABSOLUTELY KNOWS that he is going to tell the authorities about her when he gets caught, so the fact that she is still even around would indicate that the jig isn't even close to being up yet. The fact of the matter is that fraud and other crimes that would be the most likely underlying funding for this are crimes that are slow to be investigated heavily for quite a while. Usaully someone disputes charges, if they haven't done so before the bank writes it off, if they have the bank will deny it as to the financial institutions repeatedly being a "victim" means you really are the culprit. My personal opinion (In a past life I was involved in this kid of stuff) is that more then likely she does small scale fraud and funnels the proceeds to bitcoin because it is a very slick way to move money, especially now that you have services like the cash app with square which make it very easy to funnel money from bank account through debit or direct deposit info, you have the apps which simply let you take pictures of checks to cash them, no more needing MICR printers for fraudsters this is single handedly bringing back the check game, all these various online companies like paypal and netspend all trying desperately to be real banks and falling over each other trying to make themselves as accessible as possible. And at the end of it all you have social media to learn about people and get as many of the financial backing questions as you can and then you get three chances (three free credit reports) to get the tricky ones in a multiple choice timed environment that you couldn't glean from cyber stalking them and lurking their social media. But it pays off, for instance if you can get one of their credit reports and they have good credit you can immediately get a line of credit over a thousand dollars completely over the internet through paypal right now and funnel that through bogus merchant accounts... you guessed it right into bitcoin through an exchange if you keep good enough records to look legit, or if you don't bother because you are too busy cyber stalking and chatting with potential victims while cutting their hair you use local bitcoins or atms and such. In the criminal world computer crimes and a lot of other cottage industry or white collar crimes are more "women's" crimes while the men like to feel macho and go do dumbass gangster stuff with guns and such. It's really a very silly culture but a chick is exactly who you would expect to be a fraudster, they are great at social engineering, it's a manipulative and passive agressive crime. I'm not saying that men don't do it too, I'm just saying when a woman wants to make money illegally and they don't want to do sex work, this is usaully what they end up doing, there are a lost of stigmas and obstacles for a woman to overcome to be a stickup artist or even a drug dealer (individuals think they can con women easier and they seem much easier targets for robbery. Even if they are tough as ails and not easy targets they will deal with significantly more ATTEMPTS which are always at least minor setbacks in some way shape or form)
But that brings me to the other crime I would suspect she is involved in which is sex work. She could moonlight doing online shows or even escorting at night, sex work, especially live media streams has increasingly turned towards bitcoin based payment options. The ways that the money is coming would seem to indicate this is a possibility. Unlike fraud, these individuals are willingly paying for a service and will be much more eager and less suspicious to send bitcoin based payments themselves to whomever, even some dude who like free haircuts. If fraud is what she is doing she likely has complete control over the funds long before they become bitcoins.
Those are just my speculations from personal experience, in any case she is up to something dude, she would have been more transparent otherwise. She is probably shocked you haven't asked any questions about this. Like I said she is going to have some degree of an idea, even just down to intuition when it is about to collapse and she will be gone when that happens. I would not panick and go straight for hiring a lawyer, yes you are on surveillence footage but it is not kept for very long so unless the police are following you around and obtaining the footage on the fly. Stop doing this activity, if the police are already investigating and have enough evidence for a conviction you will know VERY quickly after your behavior changes (you stop doing the mule runs). If this happens TELL THEM ABSOLUTELY NOTHING, even stuff you think is showing your are innocent can still nail you for some kind of violation you don't think exists or shouldn't exist but does and they will use it against you. They aren't lying when they say that anything you say will be used against you. At this point there is no talking yourself out of it, suck it up keep your mouth shut, chances are they jumped the gun and you will be ORed on your initial appearence anyways because they were depending on you to say something to give them that little bit of evidence they needed for the charges to stick at initial appearance. But absolutely don't tell them anything and at this point think about the lawyer. Odds are the only one who doesn't know you are a patsy is you and unless the jaws are about to be closed on this, you will be allowed to walk away if you do it now.
So tl;dr is just stop it, right now, find a new barber and pay for haircuts. Don't go crazy and overreact and confront this girl, don't go shopping for a lawyer (if she is a serious criminal this will make her very very nervous, and it will likely cost you a LOT of money you don't need to spend since I personally don't think you are in it deep enough to need one yet) Just walk away from it all, and check your credit reports in a couple months because if she's a fraudster I guarantee she knows everything about you to take you for all your money and put you deeply in debt at this point. And the second you are no longer her mule you are of no use to her otherwise.
One thing I forgot to talk about is the micro payment structure. This is specifically done to expedite the transaction. Over certain thresholds the transaction has to be halted and reported to the federal government to see if they think this is money laundering or terrorist funding, them giving the nod that no you aren't collecting money for terrorism take a day or two, but single transactions under the threshold don't trigger this. Obviously it is cumbersome to try and send like 80 thousand dollars in 499 dollar increments but if you are sending an amount that barely crosses that threshold like 5 thousand, it is very much preferable to send it as micropayments, the bank will probably even suggest it as it doesn't get tied up for a couple days in bureaucracy. So the micro payments don't automatically set off a red flag, this is a common legal loophole to make a transaction in the low thousands happen much much faster, no one wants that transaction to sit there an extra two days, the feds don't really want to investigate some white person sending some other white person 6 thousand dollars, but it is the law if it is sent as a single payment and the bank will have to comply.
That being said the individuals who usually learn this trick first and almost universally know it are individuals who have been in the criminal justice system. You learn very fast to make your money order court payments in micro payment increments and put money on a friend of family member's inmate account as such as well when they are locked up (a single payment over the threshold to an inmate will generally be more on the timescale of a week or two to clear).
But the flip side of this is that more then likely it wasn't really reported to the IRS, unless he accumulated a massive amount in a short period all through the same method of transfer. More then likely these were small enough and spread out enough that it wont get reported in a way that will be glaringly obvious to the FBI, a good way to check is to try and apply for government benefits and see if these income sources pop up there, yeah you will get denied but applying for government benefits is free and they source the same reporting generally that the IRS does, in fact they source exactly the same reporting that the state tax audits will refer to. My guess is you are filing singe with a modest income shown on w-2s and that's about the extent of your income tax filing for the most part, if I'm right your audit risk is hella low and you really shouldn't sweat the tax implications of these micropayments, there will be no evidence that you ever deposited even a red cent of this money into any kind of account you have or converted it into any reportable purchase like a car or medical bills or real estate, they have no way of proving you wrong when you act shocked and say you had no idea this happened and your identity must have been stolen, thank you so much for letting you know. This is an outrage if you ever find out who did this, blah blah blah.. You didn't keep any of that money, don't freaking pay the tax on it. If she is laundering properly she is paying tax on that same money anyways to get it into her legit accounts (wow 500 dollars of tips again! yeah she is supposed to pay tax on that)