Traffic Analysis allows to reveal majority of users on Tor Network
openrev.org
openrev.org
It's an active attack, meaning it requires packet modification. Its been done to death, see stream watermarking, etc.
Show me an effective passive attack with a powerful but non-global adversary and I'll be impressed.