It is a volume+timing attack. From 2014:

https://www.bbc.com/news/technology-28573625

"The Tor Project suggests the perpetrator compromised the network via a "traffic confirmation attack".

This involves the attacker controlling both the first part of the circuit of nodes involved - known as the "entry relay" - as well as the exit relay.

By matching the volumes and timings of the data sent at one end of the circuit to those received at the other end, it becomes possible to reveal the Tor user's identity because the computer used as an entry relay will have logged their internet protocol (IP) address."