There’s only been like 3 times mainly that have been found out about publicly at least
OnionDuke Malware (2014)
Operation Onymous (2014)
Tor Exit Node Malware Campaign (2020)
So it can happen but doesn’t happen often and the people who pull it off usually have virtually unlimited funding to do it. For the common person its still safer than rawdogging the internet
IIRC only for a tiny, non-selective subset of users unlucky enough to pick your two bad nodes. Otherwise Tor would basically be dead.
There’s only been like 3 times mainly that have been found out about publicly at least
OnionDuke Malware (2014)
Operation Onymous (2014)
Tor Exit Node Malware Campaign (2020)
So it can happen but doesn’t happen often and the people who pull it off usually have virtually unlimited funding to do it. For the common person its still safer than rawdogging the internet