What is suitable punishment for stealing $15 on Xbox Live?

For Easter I got a $25 gift card. I bought a $0.99 item and left it until Minecraft Xbox One comes out. Anyway today my account got charged $14.99 for buying Terreria. I didn't buy it.
(This part's speculation) Within 10 minutes of it being charged, my friend started playing it. He has never owned it. He always replied to my messages quickly while online, now I asked him about it and he hasn't replied. It's been hours.
Anyway, I'm 99% sure he bought it with my account, so what's a good punishment for A: Hacking my account. B: Stealing $15?

Added (1). Is there any way I can effectively report him? The normal way seems to not do anything.

Hack his account and steal $20

Wait? He can't use the game if it's on your hard drive, and if it was bought by your account. Also check his gamertag and achievements to see if there's a history of Terreria. If he has an achievements on the game he can't erase them, it's there forever. Now if you want to you can call Microsoft and ask them about the transaction and basically say you never bought the game, that your account was hacked.

Change your passwords and call microsoft and report him for hacking