Also I believe there were some traffic correlation attacks where the attacker was able to get netflow data from both entrance nodes and (?) the traffic destination outside of Tor.