In the case against where the child porn forum “BoysTown” was taken down, it was directly noted on news that the admins were arrested due to German police performing traffic analysis.
The “Liberty Lane” string deanonymizations of CP viewers also seems to have been a case of deanonymization by spinning up malicious guard nodes but the details are murky since its “TOP SECRET”.
If I’m not mistaken - both happened around the KAX-17 incident.