333 Tor relays stole server passwords
Attackers used 333 hacked Tor relays to steal server passwords from the 1st to the 5th of October 2026, The Hacker News reported. The Tor Project removed them and told volunteers to check their machines.
Tor Project: 333 relays stole loginsAttackers used 333 hacked Tor relays to steal server passwords from the 1st to the 5th of October 2026, The Hacker News reported. A researcher called kaba found them in a scan of about 3,000 exit relays on the 2nd of October, the report said.
The Tor Project warned its volunteers about the hacked relays on the 5th of October, its mailing list shows. By that day none were left on the network, The Hacker News reported.
How Tor's roughly 3,000 exit relays and SSH logins work
Tor hides where internet traffic comes from by passing it through computers run by volunteers, called relays. An exit relay is the last stop before traffic leaves Tor.
SSH is a tool for logging in to a distant server, a computer that runs websites or stores files. Each server shows an ID code called a key.
12 fake servers took passwords from users who accepted a fake key
The hacked relays sent SSH logins to 12 fake servers that showed their own key, The Hacker News reported. A user who accepted that key and typed a password handed it over, the report said.
Logins made with a key file in place of a password could not be stolen this way, The Hacker News reported.
Below we break down the 333 relays
333 of about 3,000 exit relays is about 11%, by our arithmetic. They sent logins to 12 fake servers, about 28 relays per server, by our arithmetic.
At their peak on the 4th of October, the hacked relays carried 7.46% of Tor's exit capacity, The Hacker News reported. The 333 figure counts relays and leaves out how many people lost a password.
The Tor Project's notice of the 5th of October told owners what to do
The Tor Project told volunteers to take any hacked relay offline and reinstall it. It also told them to change every password on the machine.
What is confirmed and what is not
The Tor Project's notice confirms the hacked relays caught logins. The count of 333 comes from The Hacker News, and no source has counted the victims.
Key facts
333 hacked Tor relays caught server logins from the 1st to the 5th of October 2026.
Logins went to 12 fake servers.
Only users who accepted a fake key and typed a password were exposed.
No source has counted the stolen passwords.