I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method

I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method of exploitation compared to Sybil attack? It’s a good question. Keep in mind that, while exit node IP addresses are public, it’s generally difficult (and sometimes impossible dependent on NAT) to enumerate all the IP addresses of non-exit nodes. You would need to operate a malicious directory server (probably not that hard) and/or crawl the DHT (new in v3, I’m not yet familiar with it). I believe Tor also has explicit mitigations against this sort of enumeration, by eg directory server hashing the first bits of the client IP with a nonce for the current time period. But I don’t know the details and it’s been a long time. It’s also worth noting that Zerodium has quite a large bounty for targeted deanonymization of Tor users.