Re:Thousands of Tor exit nodes attacked cryptocurrency users...
by DSingularity on Sunday May 09, 2021 @11:14AM
(#27096622)
If they control the relay and the exit mode then they can force http and mount MITM attacks on subsequent traffic of the user didn’t notice. This allows them to replace the destination address with their address and the user will be robbed of his cryptocurrency.
Like you, I imagine plenty of governments run exit nodes just to see what's happening and keep the system working for their own uses.