For more than 16 months, a threat actor has been seen adding malicious servers to the Tor network in order to intercept traffic and perform SSL stripping attacks on users accessing cryptocurrency-related sites.
Article Link: Thousands of Tor exit nodes attacked cryptocurrency users over the past year | The Record by Recorded Future