Lot's of TOR nodes are banned from many places on the Internet for the Freedom Hosting takedown the FBI did. They also injected (Reverse Eng) people's browser with javascript on a specific exploit and found their Real IPs too. Not hard, TOR was made by the NAVY if anyone recalls. So yeah, OP that can happen, even the relays and exit-nodes. People in-between, can all get caught.
My thoughts though are what exactly is the script they used, how did it work, i can't find it anywhere online -_-