The unknown hacker is using Tor exit relays to remove encryption on bitcoin mixer services and change wallet addresses from users to their own.
Agora has announced it will shut down temporarily while it explores defence mechanisms against attacks which could identify its servers and operators.