You are confusing two things, one is the sudden increase in tor traffic you linked to, and which was possibly caused by a botnet which used tor as command & con

You are confusing two things, one is the sudden increase in tor traffic you linked to, and which was possibly caused by a botnet which used tor as command & control network. The other is the attack on freedom host, which the FBI perpetrated. There the FBI injected a trojan into websites and could therefore deanonymyze users of the websites. So in that case tor did protect the malware as designed, but could not protect the anonymity of the user, because the local computer did made a connection over TCP/IP.