One researcher found 333 Tor exit relays quietly intercepting SSH sessions

The scan that caught them

The author used exitmap to open an SSH connection from one server to another through each Tor exit in turn and check the host fingerprint. About a dozen relays served a fake fingerprint; over 300 redirected SSH traffic through the attackers' servers. They reported to the Tor Project's network health team, who flagged the relays BadExit.

According to the write-up, the attackers had compromised Linux servers in August with the Ebury 1.8.3 backdoor, turned non-exit relays into exits, and used them to steal passwords and infect more servers. They also collected unencrypted mail. The author guesses a financially motivated group; the entry point is unknown.

Key login would have starved the interceptors; the warning only helps if you have history

The stolen passwords were the avoidable part. A commenter who stepped through what the attacker could and could not do argued that with SSH key authentication the man-in-the-middle is left with very little:

"even if the client accepts the forged server key from a MITM server, the real server won't accept the client key exchange… It can't steal your password, since the private key never leaves your client"

The host-key warning that exposed the operation has a gap too. A commenter in the thread noted it only fires for people who already have a known-hosts entry:

"If your security requirements are so high your PC contains no evidence whatsoever of what you were doing over Tor, you wouldn't get the banner."

The same people who keep no trace are the ones who never see the warning, so for a first connection over Tor the only defence left is a key login and a fingerprint checked out of band.