How Many Malicious Tor Exit Nodes Are There?

This article examines the prevalence of malicious exit nodes within the Tor network, detailing estimated numbers, common threat activities, and defense mechanisms. While the exact count constantly fluctuates, cybersecurity researchers estimate that malicious or compromised relays typically account for anywhere from 5% to over 20% of the total exit node capacity at any given time. Understanding these numbers helps clarify how the network operates, what threats users face, and how Directory Authorities work to remove hostile nodes.

The Numbers: Estimated Malicious Exit Nodes

The Tor network generally maintains between 1,000 and 1,500 active exit nodes globally. Based on threat intelligence reports and ongoing tracking by independent researchers, anywhere from 50 to 300 exit nodes may be operating with malicious intent or compromised configurations at a given time.

Because individual threat actors often spin up hundreds of lightweight virtual servers simultaneously, researchers measure threat impact by both node count and exit probability. During large-scale coordinated campaigns, hostile operators have managed to control upwards of 10% to 27% of the total exit relay capacity before being detected and removed.

Common Malicious Activities

Exit nodes are the final hop in a Tor circuit, decrypting traffic before forwarding it to the public internet. Hostile actors deploy exit nodes primarily to intercept or alter unencrypted traffic through several methods:

• Cryptocurrency Hijacking: Modifying plaintext web traffic to replace Bitcoin and Ethereum addresses with the attacker’s wallet addresses during transactions.
• SSL Stripping: Downgrading secure HTTPS connections to unencrypted HTTP to harvest credentials, session cookies, and sensitive personal information.
• Traffic Snooping and Correlation: Monitoring destination IP addresses and timing patterns to deanonymize users or map out hidden services.
• Ad Injection and Payload Modification: Injecting unauthorized advertisements, tracking scripts, or malicious binaries into unencrypted downloads.

Major Documented Threats

A notable example of malicious node scaling was the threat group tracked as KAX17. At its peak between 2020 and 2021, KAX17 operated hundreds of coordinated relays, briefly controlling more than 25% of Tor’s total exit capacity. The group focused heavily on traffic correlation and user tracking rather than crude payload tampering, making detection more difficult.

Smaller, financially motivated groups regularly launch clusters of 20 to 80 nodes configured specifically to execute automated man-in-the-middle attacks on cryptocurrency platforms and darknet marketplaces.

Detection and Mitigation

The number of malicious exit nodes is dynamic because the Tor Project and community researchers actively hunt and neutralize them:

• The BadExit Flag: Tor Directory Authorities can assign a BadExit flag to any relay displaying suspicious routing, traffic tampering, or unauthorized port blocking. This flag prevents the node from serving as an exit point while allowing network operators to investigate.
• Automated Scanners: Automated testing suites continuously send test requests through all known exit relays to detect payload tampering, TLS manipulation, and certificate spoofing.
• User Protection via End-to-End Encryption: Using HTTPS (with HSTS) and connecting directly to .onion services (which never leave the Tor network) renders exit node snooping largely ineffective, as attackers cannot read or modify encrypted payloads.