I believe there are many podcasts out there where he states that he used legacy addresses, which means he would probably be using a very, very old coldcard if at all. Or at least a seed that was generated well before the vulnerability.
It seems like the initial debit hold on funds that got rejected still hasn't dropped off your bank account yet. I'd say by Wednesday everything should sort itself out if that's the case.