Perhaps because your ISP can't see Tor usage (though bridges do that better), but now the VPN provider knows your real identity and that you're on Tor, a correlation choke point with payment records attached. Plain Tor never asks who you are. This is negated with some VPN provider though as not all require KYC. If you're using a private VPN and then from their connecting to Tor, you're most likely fine.
If you're connecting to Tor and then a VPN, that's bad. You're essentially negating Tor's random exit node. Tor exits rotate per circuit, a VPN exit doesn't, so the VPN becomes one persistent observer of all your traffic, defeating Tor Browser's per site circuit isolation.
It's also technically fragile: Tor only carries TCP, so UDP based WireGuard/OpenVPN won't tunnel over it without special config.
And this special configuration is very complicated for the average person that just what's some privacy.
My two sats.
That said, three letter agencies absolutely run Tor exit nodes. Why wouldn't they? They'd be terrible at their jobs if they didn't.
npub18a…tp424
2026-09-13 16:32:03 UTC
in reply to nevent1q…rw9q
Author Public Key
npub18ams6ewn5aj2n3wt2qawzglx9mr4nzksxhvrdc4gzrecw7n5tvjqctp424Seen on
wss://nos.lolPublished at
2026-09-13 16:32:03 UTCEvent JSON
{
"id": "00000354fff90b7d51f86b0a61bfa850e7863d22d7e48a0a4fe5f654cb9f5c45",
"pubkey": "3f770d65d3a764a9c5cb503ae123e62ec7598ad035d836e2a810f3877a745b24",
"created_at": 1789317123,
"kind": 1,
"tags": [
[
"e",
"0000b9a40ce482a1d27031fd6e1abb929c31ef4f86678491c5edb577e93bf5d1",
"wss://relay.primal.net/",
"root",
"64acf4055fa826bcab8457e24ef8fba7490abb1e76dbab6aa8752a53a0eb4d4a"
],
[
"e",
"0000035c1dbcd716da05100710de675acb4f71b7017721565fee335ddf7a6584",
"wss://relay.primal.net/"
],
[
"e",
"99ac03fd9618610e13333061a09d39458239cdabc696bb92d52f90c40a91c761",
"wss://relay.damus.io/",
"reply",
"8e1e3efef6509b9efc453d83590940b6e6557307d58b89d5f70f4f8547cc6e09"
],
[
"p",
"6f0cc771674c2494627c931077dce22ac4ee24517abe5f7233afc0550c70de9e",
"wss://nostr.mom/"
],
[
"p",
"64acf4055fa826bcab8457e24ef8fba7490abb1e76dbab6aa8752a53a0eb4d4a",
"wss://offchain.pub/"
],
[
"p",
"8e1e3efef6509b9efc453d83590940b6e6557307d58b89d5f70f4f8547cc6e09",
"wss://nos.lol/"
],
[
"client",
"Amethyst"
],
[
"nonce",
"200ODE",
"21"
]
],
"content": "Perhaps because your ISP can't see Tor usage (though bridges do that better), but now the VPN provider knows your real identity and that you're on Tor, a correlation choke point with payment records attached. Plain Tor never asks who you are. This is negated with some VPN provider though as not all require KYC. If you're using a private VPN and then from their connecting to Tor, you're most likely fine.\n\nIf you're connecting to Tor and then a VPN, that's bad. You're essentially negating Tor's random exit node. Tor exits rotate per circuit, a VPN exit doesn't, so the VPN becomes one persistent observer of all your traffic, defeating Tor Browser's per site circuit isolation.\n\nIt's also technically fragile: Tor only carries TCP, so UDP based WireGuard/OpenVPN won't tunnel over it without special config.\n\nAnd this special configuration is very complicated for the average person that just what's some privacy.\n\nMy two sats.\n\nThat said, three letter agencies absolutely run Tor exit nodes. Why wouldn't they? They'd be terrible at their jobs if they didn't.",
"sig": "eba568d177918c9f20d7d9e3f8ea5bd8e68612664e30cdd6c6ae96b12c042e655d30517de8b0b74e72880cb00fc77c27e1d7cfe14987b4bbf52a07dadef56b13"
}