From what little I've heard, de-anonymization of Tor users is largely done by targeting their devices with zero-day exploits. That is still a valid method, I wouldn't trust Tor personally, but I'm with the Tor project that there is no credible evidence of a large scale de-anonymization attack.