This contains no definite info. The victim/user doesn't even know if he accessed the SSL version of the Blockchain site. Blaming it on Tor is presumptuous. It

This contains no definite info. The victim/user doesn't even know if he accessed the SSL version of the Blockchain site. Blaming it on Tor is presumptuous. It could just as easily have been a local exploit (keylogger/malware), not accessing the SSL site, an exploit of the Blockchain site itself, etc.