IIRC it was an attack based around deductive assumptions from controlling a preponderance of the endpoints, definitely not actually stripping encryption or going through all the anonymizing hops. I was looking for anything that might help me remember what it was but all I can find is an attack from this year with 25% of endpoints stripping SSL to rewrite bitcoin transfer addresses lol