so the deal with subdomain vs domain is that you need to think of them as two separate sites; one is just living in the same database as the other. So when you moved the site over to a subdomain, it's possible you took a little hit but I don't think you would get penalized for having the main site live on the subdomain. It might come down to how you migrated and managed the redirects (did you map everything appropriately?), lost links because people were still referencing the old domain with the www subdomain, and a variety of other factors.
The .co ccTLD is actually for the country of Columbia, and isn't for "company" as some people may use it for. While there are a ton of spammy sites that use the .co because it's easier to snag an exact match domain, that doesn't necessarily mean you're being targeted for it. There are billions of websites out there. Having the .co and hosting in the US could send mixed messages, which may impact; however there's no real way to tell with any certainty.
Review your site migration, and make sure you have all the pages moved over correctly. Next I would check links. Reach out to people who are linking to you and ask them to update to the new domain. 301's lose a good percentage of equity passed, so it's better to get the full value with the correct link. Check local directories as well to make sure you cover all bases - those will need the URL updated. Finally, review your on-page optimization. Are you targeting the right keywords? If so, do you have the appropriate pages optimized and set up with good internal linking?
Check your traffic in analytics to look for specific dates it either spiked or dropped. That will also help you narrow down what you changed/what you need to change. Things like this are more detective work in the beginning to bring problem areas to light.
Start with that and let us know what you find.