As far as I know, Tor is theoretically vulnerable to a correlation attack by an entity capable of monitoring the entry and exit nodes. Personally, I thought having this capability, plus actually implementing the attack was a bit far-fetched for most cases.
However, reading about what the NSA might or might not be be doing, plus the fact that GCHQ is tapping the transatlantic cables and knowing that the US and western European intelligence agencies tend to cooperate, I'm not so sure anymore. I think at this point we can assume that other countries have similar capabilities as well. Knowing that the infrastructure for this kind of attacks is in place, I think the cost is a lot lower than I would have expected a few months ago.
I'd be interested to know if the number of people running tor servers, or if donations of servers, or donations of money to fund servers, has increased much recently.
How many machines would Tor need to make traffic analysis tricky?
However, reading about what the NSA might or might not be be doing, plus the fact that GCHQ is tapping the transatlantic cables and knowing that the US and western European intelligence agencies tend to cooperate, I'm not so sure anymore. I think at this point we can assume that other countries have similar capabilities as well. Knowing that the infrastructure for this kind of attacks is in place, I think the cost is a lot lower than I would have expected a few months ago.