Can Tor be traced? What actually identified people, and what never did

How people got caught using Tor

Five episodes get told as "Tor was cracked." Read against the documents, none is a documented break in Tor's routing that named someone. Silk Road was the operator's own trail. Freedom Hosting and Playpen went through a browser bug and through malware on servers the authorities already had. Ricochet was one old chat app. KAX17 was an attempt on the relays, with no public count of users identified.

The case that is still moving is a paper, not an arrest. For the 2026 ACM CCS conference, a team describes a traffic-correlation attack it calls ESPRESSO, and reports that in the lab it can match the two ends of a Tor connection at a high true-positive rate and a very low false-positive rate. That measures the threat Tor has always said it does not defend against. No police operation in the paper uses it.

Tor traffic correlation: the attack Tor does not claim to stop

An observer who can see both you and either the website or your exit relay can correlate the timing of traffic as it enters the Tor network and as it leaves. "Tor does not defend against such a threat model." Nobody in the middle needs to break a cipher. The packets going in and the packets coming out have the same rhythm, and a patient observer matches the rhythm.

Tor's support page puts a limit on how useful that is in ordinary policing. A censor or a law-enforcement agency that can watch "parts of the network" can check a suspicion that you talk regularly to a particular friend, by correlating only that traffic. "In most countries, the suspicion required to obtain a warrant already carries more weight than timing correlation would provide." On that telling, correlation confirms a theory you already had. It does not hand you a name out of millions of flows.

The 2026 paper argues the same family of attack has got better at the fishing problem, inside a lab. ESPRESSO, written up for CCS 2026 in The Hague (15–19 November 2026), reports an 88% true-positive rate at a false-positive rate of 10⁻⁵, about one false match in a hundred thousand. The authors say that held when the observer saw as few as 500 Tor cells, and when the matching flow was rare, down to a base rate of 10⁻⁴. Their new datasets hold about 503,000 entry-exit flow pairs. The adversary they describe is "a state-level actor, a major ISP, or an entity operating malicious Tor relays," watching entry and exit and matching the two. They call flow correlation "a severe, imminent threat" and say practical defenses are still needed.

Tor is talking about a typical warrant: you already suspect two parties, and the timing checks the suspicion. The paper is talking about a captured dataset, a modern matcher, and an observer that already sits on both ends and is trying to pick the right flow out of a crowd. Neither document says a police force has used ESPRESSO on a real user. If your threat is a government that can watch your home connection and the server you are talking to, this is the residual risk, and no security level inside Tor Browser is claimed to close it. Adding a VPN does not remove an end that adversary already has. Who sees you in each Tor and VPN arrangement is the comparison, if that is the decision in front of you.

Has Tor been cracked, or was it the browser?

The phrase "has Tor been cracked" usually points at 2013, and at a hosting service called Freedom Hosting. What the Tor Project wrote at the time is narrower than the retelling.

On 4 August 2013 the Tor Project said someone had exploited the software behind Freedom Hosting, a hidden-service host that is not part of the Tor Project, and had configured the server to inject JavaScript into pages. "This exploit is used to load a malware payload to infect user's computers. The malware payload could be trying to exploit potential bugs in Firefox 17 ESR, on which our Tor Browser is based." The post names no agency. It says the authors had no insider information.

Mozilla had already published a bug in that browser. On 25 June 2013, MFSA 2013-53: crafted content using the onreadystatechange event and page reloads could crash Firefox by executing unmapped memory, and "this crash is potentially exploitable." The fix shipped in Firefox 22 and Firefox ESR 17.0.7. Six weeks later the Tor post describes a payload that could be aimed at Firefox 17 ESR. The post never cites the advisory number, so the link between them is the date and the browser version, which do line up.

The man charged with running that kind of host was found on a hosting invoice. An amended criminal complaint in the District of Maryland charges Eric Eoin Marques with operating a free anonymous hosting service on an anonymity network. Agents identified a server IP that resolved to OVH in Roubaix, France. OVH's records named Marques as the subscriber. He paid with a debit card in his name, billed to a Las Vegas mailbox, and the complaint says he had contracted for nearly 400 servers, then on 13 June 2013 renewed only that one. Logins reached the server from an Irish address, and on 29 July 2013, during a search at that address, Marques was there. Wired's account of the Dublin case identifies Marques as Freedom Hosting's operator. The complaint is how he was tied to the server. The August post is the payload.

Playpen shows the same split with the FBI named in the reporting from the start. In December 2014 the FBI was tipped that a Tor hidden service called Playpen was hosting child sexual abuse material. The site was misconfigured, so its real IP address was publicly visible. The FBI got a warrant and seized the server. It then kept the site online for nearly two weeks and sent malware to visitors. The FBI calls that malware a network investigative technique, a NIT. The NIT "copied certain identifying information from a user's computer and sent it back to the FBI." EFF writes that this exploited, "we believe," a vulnerability in the Firefox bundled with Tor Browser. More than a thousand computers were searched this way, under a single warrant, and hundreds of suspects were charged. Some courts upheld the operation. EFF thinks those rulings were wrong. The identification itself was the malware, sent by a server the FBI was already running, after the hidden service had leaked its own IP.

Is Tor Browser safe from that class of bug today? Safer than Firefox 17 ESR, which is a low bar, and not immune. Browser exploits are found, and then patched, on a different clock from the routing design. In September 2024, writing about a different incident, the Tor Project said users could keep using Tor Browser to reach the web securely and anonymously, and that the network was healthy. That is not a promise that the next browser bug will spare you. It is a statement that the documented failures were not a standing hole in Tor Browser. The practical control is the current release, installed from the Tor Project and kept up to date. The install and the signature check are how you know you have that release. On an unknown onion site, the strictest security level turns off the features those old payloads needed. The browser guide lists what that level breaks, which is the point of using it.

Can malicious relays deanonymize you?

A single bad relay learns one hop. A guard sees that your IP is using Tor, and when. A middle sees two relays. An exit sees the destination, and still does not see your name. Turning that into "this person opened this site" means one operator seeing enough of the path to stitch it, often enough that the odds stop being theoretical. KAX17, as The Record describes it, was that attempt. The Ricochet case further down was a different trick, against one old app.

The Record reported in December 2021 that a threat actor it tracked as KAX17 had, since at least 2017, run servers in entry, middle and exit positions "in what a security researcher has described as an attempt to deanonymize Tor users." At the peak, more than 900 of its servers sat inside a network of roughly 9,000 to 10,000 relays. The researcher, Nusenu, told The Record he had noticed the pattern in 2019 and traced it back to 2017. His measurements, as The Record published them: at one point a 16% chance of entering through a KAX17 guard, a 35% chance of passing a KAX17 middle, and up to a 5% chance of leaving through a KAX17 exit. Nusenu told The Record that most operators of hostile relays concentrate on exits, which can tamper with traffic the user did not protect. KAX17 loaded up on guards and middles instead. That is the setup you use to map a route, rather than to rewrite a page.

The Tor Project confirmed the finding to The Record. It had removed KAX17's exit relays in October 2020, another batch in October 2021, and "several hundred" relays on 8 November 2021. A spokesperson said the project was still investigating and had no attribution. The article describes an attempt. It does not report a number of users who were identified, and it should not be retold as one.

The case the Tor Project itself called a full de-anonymization was narrower, and it was an app, not the browser. On 18 September 2024 the project wrote that, from the information it had, one user of the long-retired chat program Ricochet "was fully de-anonymized through a guard discovery attack." The attacks, as far as the project knew, happened between 2019 and 2021, against a version that had neither Vanguards-lite nor the vanguards add-on. Vanguards-lite, shipped in Tor 0.4.7, is there to stop an attacker forcing circuits until a malicious middle sits next to your guard, then using connection timing to find you once the guard is known. Ricochet-Refresh, a maintained fork, has had that protection since version 3.0.12 in June 2022. An update on 10 October 2024, answering Deutsche Welle, says the project cannot confirm whether the affected onion service had Vanguard protections. Given the dates, it thinks the service probably did not, which would have made guard discovery easier. The exact method "remains unclear."

The project also said that after 2019–2021 its network-health team had flagged thousands of bad relays and the directory authorities had voted them off, including large groups run by one operator. That is the mitigation on the relay side: removal after the fact, plus a guard design that makes a single hostile relay less decisive than it was for that old Ricochet build. It is not a guarantee that nobody hostile is running a relay this week. It is a reason one hostile relay is not, by itself, a trace.

Can the FBI track Tor users? Silk Road says how they did it once

Ross Ulbricht was sentenced to life in prison on 29 May 2015 for running Silk Road. The Justice Department's announcement says the site, from January 2011 until it was shut down in October 2013, was used by more than 100,000 buyers and moved more than $200 million in illegal drugs and other goods. Ulbricht's commissions were more than $13 million. He was convicted on 5 February 2015 of all seven counts he faced, and ordered to forfeit $183,961,921. None of that release describes a break of Tor. The way agents reached his name is in the 2013 complaint, as two newsrooms reported it while the complaint was new.

The BBC's account starts with forum posts going back to January 2011. On a mushroom-growing forum, a user called Altoid began publicising an anonymous market. Months later, in an October post looking for an IT person who knew Bitcoin, Altoid asked people to write to rossulbricht@gmail.com. Ars Technica puts that Bitcoin Talk post on 11 October 2011, about nine months after earlier Altoid posts on shroomery.org and Bitcoin Talk had pointed at a hidden service and at silkroad420.wordpress.com. With the Gmail address, the agent tied it to Google+ and YouTube. Records "obtained from Google" produced IP addresses, and those addresses focused the search on an internet cafe on Laguna Street in San Francisco. The VPN provider in front of some of that was subpoenaed.

The coding site is the part that is hard to shrug off as coincidence. The complaint, as Ars reported it, said that in early March 2012 someone opened a Stack Overflow account under the name Ross Ulbricht, with that same Gmail address. On 16 March, at 8:39am, the account asked how to connect to a Tor hidden service using curl in PHP. Less than a minute later the name on the account was changed to "frosty," and weeks later the email was changed to frosty@frosty.com. In July 2013, a forensic look at a Silk Road server found a PHP script whose code matched the snippet in that discussion. The prosecutor's formulation in the complaint, quoted by the BBC: the posting "was accessible to anyone on the internet and implicated him in operating a Tor hidden service."

The dollar figures moved between the arrest and the sentence, which is worth noticing if you have seen the larger number. Ars, writing on 2 October 2013 from the complaint, said prosecutors alleged more than $1 billion in sales to hundreds of thousands of buyers. The 2015 sentencing release, cited above, says more than $200 million and more than 100,000 buyers. Both documents are real. They are not the same measurement, and the later one is the figure the government stood behind at the sentencing. What happened to the market itself, and to the markets that followed it, is a different record from how Ulbricht was named.

This is the list the Tor Project already gives police, without any special access to the network: "investigating means, motive, and opportunity, interviewing suspects, writing style analysis, technical analysis of the content itself, sting operations, keyboard taps, and other physical investigations." Ulbricht's trail is that list with the names filled in. Can police track Tor? They can track a person who leaves a trail outside it. Can the FBI track Tor, as a network? The Silk Road release does not show that they did.

Can your ISP see what you do on Tor?

Your ISP can see that you are using Tor, unless you do something extra. It cannot see which site you opened. Those are different facts, and guides mash them into "your ISP sees everything" or "your ISP sees nothing."

Tor "tries to prevent attackers from learning what destination websites you connect to. However, by default, it does not prevent somebody watching your Internet traffic from learning that you're using Tor." The watcher in that sentence is whoever is on your local network: an ISP, a campus, a hotel, a government tap on the wire into your building. They see a connection to a Tor guard. They do not see the site name at the far end. The fix Tor names, if the fact of using Tor is itself the problem, is a bridge rather than a direct connection to the network. The same page adds the social version of that protection: the more ordinary Tor users there are near you, the less it means that you are one of them.

The website at the other end sees a connection from an exit relay. It does not see your home IP. It learns who you are the moment you tell it. If you only visit, "they don't know who you are or your true location." If you sign in, "they still don't know your location but they know who you are." If you type a name, email, address or phone number, "you are no longer anonymous to that website." That is the whole of most real deanonymizations that never make a paper: the site did not trace Tor, you logged into it.

Two habits on that same page defeat the design outright, because they open a connection that is not Tor. Torrent clients have been seen ignoring proxy settings and connecting directly, and even a careful client often sends your real IP inside the tracker request. "Under no circumstances is it safe to use BitTorrent and Tor together." Documents opened outside the browser, especially DOC and PDF files, can fetch remote images with your ordinary IP. Tor Browser warns before handing a download to another application. The warning is the whole advice. Plugins such as Flash can be pushed into revealing your IP, which is why Tor Browser blocks them, and why adding extensions is a way to undo that.

Who can actually trace a Tor user

Put the cases and the design in one place. "Trace" here means attach your real identity to something you did, not merely notice that Tor exists.

What actually gets a Tor user identified

The cases cluster. None of them starts with someone solving onion routing on a Tuesday. Naming the fact those traces revealed, and the person who could use it, is what OPSEC is for, and it comes before another tool.

• A name you already used. Altoid, a Gmail address with a real surname, a Stack Overflow account opened under a legal name and renamed a minute too late. The posting was public. Tor was irrelevant to it.
• An account on the site you are trying to hide from. Signing in ends anonymity toward that site even when the exit IP is all it can see. Reusing a username does the same job more slowly.
• An old browser, or an old app, with a bug the other side already has. Firefox 17 ESR in 2013. Ricochet without Vanguards, years after the protection existed. The mitigation is the current Tor Browser, not a different network.
• A file or a torrent that phones home around Tor. The ISP never had to correlate anything. The application sent the real IP itself.
• A server that was sloppy. Playpen's hidden service exposed its own hosting IP. Marques was on the hosting invoice. Operators get found through the machine, and visitors then get found through whatever the machine is made to serve.

If the consequence of being identified is more than embarrassment, the browser on your everyday laptop is the wrong boundary. Malware that leaves the browser, and a disk that keeps what you did, are the gap the Playpen NIT sat in. Tails and Whonix draw that boundary in different places, and which one fits depends on whether you need a session that forgets itself or a machine you come back to. That choice does not defeat a both-ends observer. It does change what a seized laptop, or a payload aimed at the browser, has left to find.

Is Tor safe, and is Tor anonymous, for an ordinary person?

For the job Tor Browser is built for, yes. An ordinary person hiding their browsing from websites, advertisers, and a local network that is merely nosy is using the tool that matches the threat. Tor's own caveat is the right size: perfect anonymity is not on offer, Tor only covers applications that actually send their traffic through it, and a watcher on your connection can see that you use Tor unless you use a bridge. Within those limits, the public cases do not show a police force reading your destination out of the network because you opened a news site.

Is Tor anonymous? Toward a site you never log into, and toward an ISP that only sees the first hop, yes. The moment you identify yourself, that site knows who you are. Against an adversary camped on both ends, Tor does not make the promise. Is Tor safe? For a casual observer, and against the version of these stories in which someone cracked the network, yes. It will not protect you if you use it to commit a crime, and it will not save you if you open a document or run a torrent inside it. The project's 2024 answer, after the Ricochet reporting, was that for the great majority of people protecting their privacy while browsing, Tor was still the best option they had, and that people could keep using Tor Browser.

You want websites and your ISP's logs of destinations off your back

Use a current Tor Browser, from the Tor Project, and do not sign in to anything that knows your real name. That is the whole setup for this threat.

Being seen to use Tor is itself a problem

Use a bridge. Your ISP then has a harder time saying the connection is Tor. They still cannot see the site.

Someone may seize the computer, or you are opening sites you do not trust

The browser's strictest level, and a system that does not keep the session, matter more than a new relay trick. The Tails and Whonix comparison is the decision.

You are up against a government that can watch your wire and the server

You are in the threat model Tor writes down and then declines to defend. ESPRESSO is the 2026 evidence that the matching is no longer academic. No page can honestly tell you a setting that ends it.