OP is also posted in
Bitcoin Technical Support and he/she is obviously forgot on this thread.
Thanks for the help everyone. At this point, all indications point towards an insider job. We have traced the chain of custody and it is unrelated to any technical issue with Trezor.
So it is clear that there is no problem with Trezor, insider job probably means that some of victim family/friends took advantage of the opportunity and wipe out his hardware wallet. Since it is over 35
BTC stolen this is classic case for police, the thief probably left some traces. What we can learn from this that
even coins are on hardware wallet and seed written down on paper does not mean we are safe.
Most people find it hard to believe family and friends would steal from them.

Anyway, I had a previous thread asking for suggestions on encrypting or storing the passphrase more securely. The method I ended up using is taking a jigsaw puzzle and marking some pieces in the back. I then made a grid with several words on it (unencrypted though) and the words in the phrase correspond to the markings on the jigsaw. The the grid is the cut up.
To get the phrase, the grid need to be assembled correctly and the jigsaw assembled on top. The marked jigsaw are then removed, revealing the word. Which they then need to sort in the correct order. Threw in an extra incorrect word to make that harder. Not as secure as encrypting it but you can break them into even smaller groupings, making it harder for one person to assemble it but still easy enough for the owner to use since he's familiar with the sequence.
I would still like to hear from OP, if ever they'd be able to track who did it and how.