With standard POSIX sed you can do it, although it's more complicated:
md5sum input.txt | sed -E 'h;s/^(.{4}).*$/\1/;x;s/^.{4}(.*)$/\1/;s/./x/g;H;x;s/\n//'
Here is what the sed script does:
h copy the pattern buffer into the hold buffer
s/^(.{4}).*$/\1/ keep just the first four characters in the pattern buffer
x exchange the pattern buffer with the hold buffer
s/^.{4}(.*)$/\1/ keep all but the first four characters in the pattern buffer
s/./x/g replace each character with an x
H append newline and x's to hold buffer (which has the first four)
x exchange again; the pattern buffer has an extra newline, though
s/\n// remove the newline from the pattern buffer
The pattern buffer now has the first four characters plus x's for all the remaining characters; the cycle ends, and it is printed out.
Note: the -E switch enables extended regex syntax. It isn't strictly necessary here; instead, a backslash could be placed before each open and close parenthesis, but I think it's hard enough to read without extra backslashes in it.
md5sum
starts with a backslash\
. I shall assume that such starting (optional) character should be allowed, right?