xchainjs-lib VS airgap-coin-lib

Just to clarify, I haven't looked at the ThorSwap code in a while, but you're not sending your keystore file + password to their server. For keystores, all the magic is done via https://github.com/xchainjs/xchainjs-lib on the frontend. I believe XDEFI is using the same library. Transactions are signed frontend and sent to their respective chains. That said, I feel bad for OP, and not sure how they were hacked. If the keystore was created on ThorSwap, it's definitely worth bringing it up on their Discord. But just to affirm, using a hardware wallet is preferable.

The audit reports have been released over 2 years ago (shortly after the audit report was done) and are available on github: https://github.com/airgap-it/airgap-coin-lib/tree/master/docs/audits

That being said, I can tell you a little bit about our experience. We developed our wallet to be blockchain agnostic from the start. All the coin specific logic is located in a shared library that is used in both the Wallet and Vault application (https://github.com/airgap-it/airgap-coin-lib/tree/master/packages/core/src/protocols). We have an interface for methods to prepare, sign and broadcast transactions, as well as generate addresses and fetching balances. To add a new coin, all you have to do is add a new class to the shared lib, implement all the logic and then add the new chain to the "supported protocols" in the apps. Everything else is handled automatically (besides coin specific features like staking, etc.)

AirGap was audited a bit more than a year ago by "Compass Security". The review is available on github: https://github.com/airgap-it/airgap-coin-lib/blob/master/docs/audits/report_85096_mobile_app_security_v1.0.pdf