Hackers steal Bitcoin through large-scale exploit on Tor

Why are sites handling transactions even offer http in the first place?