i think it has something to do with malicious Tor exit nodes.

so whatever you do, don't use Tor with web wallets