I have some questions about the significance of this claim. If I'm reading this correctly, the attack is that someone hosting a malicious Tor exit node (and we

I have some questions about the significance of this claim. If I'm reading this correctly, the attack is that someone hosting a malicious Tor exit node (and we assume that all exit nodes are compromised -- just common sense) can correlate tracker requests over the Tor network to chunks being sent to the non-anonymous IP not over Tor. In other words, this isn't really groundbreaking at all -- if you're requesting data to be sent not over Tor, and instead only proxying your tracker requests, of course that data can be correlated. You're anonymously asking for chunk 5429817, but telling the tracker to send it to your real IP address. An interesting issue, to be sure, but it's certainly not "breaking" the Tor network. A lot of people are complaining about how one shouldn't BitTorrent over Tor anyway, for courtesy of the network--and I agree--however, this is just the tracker data being proxied. That is, if you were actually sending the BitTorrent data over Tor (which would slow the network), then you're protected from this kind of attack because your unprotected IP would not request data from the honeypot. From the article: When one of the malicious exit nodes sees an attempted connection to a BitTorrent tracker, it intercepts the response and adds the IP address of one of the honeypot clients under researcher control. The user's BitTorrent client then attempts to make a data connection directly to the honeypot without using Tor, thus revealing the user's IP address to the honeypot. The article goes on to mention that users who do tunnel their traffic through Tor are still vulnerable if they use DHT, because DHT works over UDP while Tor only proxies TCP traffic.