CoinDesk reports that 3,400 of the 4,000 BTC removed during the recent Liquid Network security incident have been returned. About 600 BTC remains outstanding; at the time of the report, the source valued that portion at roughly $47 million. Discussions over the remaining funds are still underway.
The event matters less as a normal BTC price story than as an infrastructure-security case involving a federated Bitcoin sidechain. Liquid is used by market participants for settlement and asset issuance, so the incident raises questions around operational controls, key management and emergency response for that network rather than Bitcoin mainnet consensus.
Recovering most of the funds reduces the immediate loss but does not replace a technical post-mortem. The next useful evidence is the root cause of the compromise, remediation steps and a confirmed resolution for the remaining assets. The description of the actors as whitehats should also be treated as an alleged or self-described role rather than automatic proof that no violation occurred.
For BTC analysis, the boundary is important: failure in infrastructure that uses bitcoin as an asset is not the same as a compromise of Bitcoin consensus, although it can materially affect users and services holding or settling funds inside Liquid.