Correction on the module addresses — I initially pointed to the router (0x4f0055) as the vulnerable module. On-chain event logs show the actual modules used in the exploit were different:

0xDcDc4ef8C992E75bb0F300536CD93E601c8882AB — 7 ExecutionFromModuleSuccess events 0xeA18B13d11f705a68F0954f637949e1eaA7AC4ca — 1 ExecutionFromModuleSuccess event

Router 0x4f0055 was NOT an enabled Safe module at the exploit block (isModuleEnabled = false, verified at block 25980524). The money flow and drain amounts are correct — the module attribution was wrong.