The US government sabotaged Tor by means of malicious Javascript code.

Fingers point at the NSA.

Here's an explanation of the attack method. It seems that they attacked certain Tor nodes, and every user who (by chance) was routed to those nodes was attacked.

I've been told that the malicious Javascript was not introduced into Tor routing nodes, but rather into some .onion web sites hosted by the same company.