The Tor network uses servers called relays to facilitate anonymous communication. However, these relays, particularly exit nodes, can be manipulated to affect user traffic.
Tor exit node security incidents
In May 2020, a group of Tor exit relays was identified as tampering with exit traffic. These relays intercepted connections to a small number of cryptocurrency exchange websites. They prevented users from being redirected to the encrypted HTTPS version of these sites. If users did not notice the absence of the HTTPS version and proceeded to send or receive sensitive information, this data could potentially be intercepted. The Tor Project removed these attacking relays from the network in May 2020. A similar attack was identified and addressed in June 2020 when another group of relays performing a similar attack was removed.
In an October 2026 report, Ars Technica described how hackers reconfigured Tor exit nodes to favour unencrypted email traffic and redirect SSH connections through servers they controlled. A set of changes caused exit nodes to block ports used for various forms of encrypted email, while continuing to allow ports for receiving unencrypted email.
Source: https://blog.torproject.org/bad-exit-relays-may-june-2020/
Source: https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/
Mitigation and Network Infrastructure
The Tor Project’s 2020 advisory separates precautions for users and websites from action against malicious relays. It reports that the attacking relays identified in May and June 2020 were removed from the network. Removal addresses the identified relays; it does not make unencrypted connections safe.
https://blog.torproject.org/bad-exit-relays-may-june-2020/
User Safety and Encryption
Users visiting websites through Tor exit nodes should be aware of the importance of using encrypted connections. When a user visits the unencrypted (HTTP) version of a site, there is a risk that the connection could be manipulated to remain unencrypted. This could lead to sensitive information being intercepted if the user does not ensure they are on an encrypted (HTTPS) version of the site, using an HTTPS address. Websites that enforce HTTPS can help mitigate this risk. Additionally, certain ports used for email communication can be blocked by manipulated exit nodes, favouring unencrypted email traffic over encrypted forms.