There’s only been like 3 times mainly that have been found out about publicly at least

OnionDuke Malware (2014)

Operation Onymous (2014)

Tor Exit Node Malware Campaign (2020)

So it can happen but doesn’t happen often and the people who pull it off usually have virtually unlimited funding to do it. For the common person its still safer than rawdogging the internet