Out of roughly 4,000 BTC drained from the Liquid sidechain, 3,400 has reportedly been sent back, leaving about 600 BTC still missing. Blockstream's calling the actors "white hats" while negotiating a return, but plenty of people aren't buying that label. A hacker returning most of the funds doesn't erase the fact they took it all in the first place. Until that last 600 BTC shows up, treat the "good guy" framing with a healthy dose of skepticism.