Dread Pirate Sunk by Leaky CAPTCHA – Krebs on Security

  Upon examining the individual packets of data being sent back
  from the website, we noticed that the headers of some of the
  packets reflected a certain IP address not associated with any
  known Tor node as the source of the packets.

Smells like parallel construction or "intelligence laundering".

https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...