I believe there are many podcasts out there where he states that he used legacy addresses, which means he would probably be using a very, very old coldcard if at all. Or at least a seed that was generated well before the vulnerability.