A mysterious group has captured a quarter of Tor exit nodes. They replaced Bitcoin addresses