Report: since January, a group has been hijacking Tor exit relay nodes to perform SSL stripping attacks, peaking in May when the group ran 23.95% of all nodes
namely multiple bitcoin mixer services. They replaced bitcoin addresses in HTTP traffic to redirect transactions to their wallets instead of the user provided bitcoin address.” https://twitter.com/... @spazef0rze : “They (selectively) remove HTTP-to-HTTPS redirects to gain full access to plain unencrypted HTTP traffic without causing TLS certificate warnings” Running a site with a login form? HTTP Strict Transport Security (HSTS) and HSTS preloading (and @HTTPSEverywhere) is your friend. https://twitter.com/... Karin Kosina / @kyrah : “There are multiple indicators that suggest that the attacker still runs >10% of the Tor network exit capacity.” Huh. That... uh... doesn't sound good. https://www.zdnet.com/... Hakan / @hatr : What? “roughly about one out of 4 connections leaving the Tor network were going through exit relays controlled by a single attacker” “person-in-the-middle attacks on Tor users by manipulating traffic as it flows through their exit relays” https://medium.com/... v/ @jfslowik Kenn White / @kennwhite : “So far 2020 is probably the worst year in terms of malicious Tor exit relay activity since I started monitoring it... [R]oughly about one out of 4 connections leaving the Tor network were going through exit relays controlled by a single attacker” https://medium.com/... Alan Woodward / @profwoodward : Rotten Onions - how Tor might not be quite what you think it is these days - proof that networks (even distributed ones) are only as trustworthy as those providing the elements of that network https://medium.com/... Eric Lawrence / @ericlaw : SSL Stripping via Tor Exits https://twitter.com/... Nathan Lawrence / @nathanblawrence : The internet as tragedy of the commons, vol. 99999999 https://twitter.com/...
Context & Ripple Effects
This is the third documented wave of financially motivated exit-relay abuse on Tor. In 2015, attackers ran rogue relays to steal Bitcoin directly from Blockchain.info users, and a later report found that twice in 2021, over 25% of Tor's exit capacity was known to be malicious, again aimed at crypto-related sites. The new finding — an unidentified group holding up to 23.95% of all exit relays since January, peaking in May — extends the same playbook: selectively stripping HTTP-to-HTTPS redirects to read plain-HTTP traffic invisibly, then swapping bitcoin addresses so mixer transactions land in attacker wallets instead of user-supplied ones.
First-order effects
- Users of bitcoin mixer services routed through compromised exits had transaction addresses silently rewritten in HTTP responses, sending their funds to attacker wallets with no certificate warning to flag the tampering.
- Operators of sites still reachable over plain HTTP — especially login and payment forms — are immediately exposed, which is why researchers quoted in the report point to HSTS and HSTS preloading as the practical defense.
Second-order effects
- Mixer operators and crypto-facing sites face pressure to enforce HTTPS-only delivery via HSTS preloading, since address-swapping only works against unencrypted HTTP responses passing through exits.
- Tor's relay-trust machinery comes under strain: when a single cluster approaches a quarter of exit capacity, detection heuristics and bad-exit flagging become the network's de facto fraud controls, not just its anti-censorship ones.
Third-order effects
- If the cadence holds — roughly a quarter of exit capacity malicious across 2020 and twice in 2021 — exit-relay hijacking looks less like an anomaly and more like a recurring monetization channel for stealing from anonymous-network users, pushing the ecosystem toward HTTPS-by-default browsing and tighter scrutiny of who runs high-capacity relays.
The trend: Tor exit-relay hijacking is hardening into a repeatable playbook for intercepting cryptocurrency payments, and each wave pushes the network further toward encrypted-by-default traffic and harder relay vetting.