They’ve gotten a number of people operating Tor sites through things like tracing crypto transactions and web hosting mistakes. One example I heard was a site that was hosted in Tor, but the images were hosted on a home server straight over the internet instead of through Tor.