How I got over 300 Tor exit nodes removed

On October 2, 2026, 333 Tor exit nodes (roughly 10% of all exit relays) were compromised and launched a coordinated attack to intercept SSH connections and steal unencrypted data, including passwords and SSH credentials. The attacker had deployed the Ebury backdoor malware two months earlier and redirected SSH traffic to interception servers while forwarding encrypted web traffic normally. After the author reported the attack to the Tor Project's network health team on Friday evening, affected relay operators shut down the nodes and they were flagged as "BadExit" by Sunday, preventing further exploitation.