My technical summary is that we now think it is the feds who initiated this 6-month long attack [1] which consisted in them using "a combination of two classes of attacks: a traffic confirmation attack and a Sybil attack." They ran many (115 to be exact) non-exit Tor relays on 50.7.0.0/16 and 204.45.0.0/16 (Sybil attack) to increase their chances of controlling both ends of a Tor circuit: the first relay (entry guard) reached by the SR2 server and the last relay used as a hidden service directory where the service is published. The feds' relays then actively modified traffic to inject a signal into the Tor protocol headers (bits encoded as a sequence of "relay" and "relay early" commands) to help them correlate traffic from one end of the circuit with the other end (traffic confirmation attack). So whenever the SR2 hidden service was being published (which happens whenever the server reconnects to the Tor cloud?) the last relay knew it was for the SR2 service (but didn't know the server IP), and could correlate it with the entry guard which knew the IP address (but didn't know the service name). Once they knew the SR2 server IP, the game was over.

[1] https://blog.torproject.org/blog/tor-security-advisory-relay...