Tor nodes

There is no definitive or publicly available figure on the exact percentage of Tor exit nodes that are "compromised" by any specific entity. 

However, we can look at documented events and analyses to understand the situation:

• Malicious Exit Nodes: There have been well-documented cases of malicious actors operating a significant number of Tor exit nodes. For example, in 2021, a security researcher found that a single, unidentified threat actor had controlled over 25% of the entire Tor network's exit capacity. While the actor's identity was not confirmed, their activity was focused on manipulating traffic to steal cryptocurrency. The Tor Project worked to remove these nodes.

  
  

• Targeted Attacks, Not Mass Surveillance: Documents leaked in 2013 revealed that the NSA and GCHQ had targeted Tor users. However, the documents reportedly stated "access to very few nodes" as well as "difficulty in combining meaningfully with passive Sigint" (signals intelligence). Instead of compromising a large percentage of nodes, focus on exploiting vulnerabilities in the Tor Browser or other software on a user's computer was used as a means to de-anonymize.

  
  
  
  

• The "14 Eyes" Argument: Some security researchers and privacy advocates point out that a significant number of Tor nodes are hosted in countries that are part of intelligence-sharing alliances like the "14 Eyes." While this is a verifiable fact, it doesn't automatically mean that these nodes are compromised. However, it does raise the theoretical risk of a traffic correlation attack if control of both a user's entry node and a later node in the circuit is reached.

  
  
  
  

In summary, while there is no public data to confirm the percentage of compromised nodes albeit the threat is real and has been documented. Historically sophisticated and targeted attacks exploit vulnerabilities in the software a user is running.