Their traditional user estimating algorithm shows around 500,000 normal users + 25,000 bridge users, their beta algorithm shows about 800,000 users + 3,500 bridge users. They are not sure which is more accurate yet. It looks like Runa estimates between 300,000 and 800,000 daily users. Apparently I over estimated in saying over a million though. Their traditional way of counting users will not count a user who connects to Tor for the first time in several days and does not stay online long enough in a 24 hour period to refresh their list of Tor nodes through a directory mirror. The beta counts people who bootstrap at the directory authority servers and the directory mirrors. http://www.terrylucy.com/post/6617697313/should-we-all-be-using-tor-to-help-protect-ourselves Once you have it narrowed down to 120 you can do an intersection attack trivially against I2P users. You just need to continuously route data through their nodes waiting for them to disconnect, and try to correlate the online activity of the vendor to the up time of the I2P router. ie: if you see the vendor responded to your private message at 8 AM, you can rule out any of the 120 nodes that were not online at 8 AM. That will let you whittle down their anonymity set size even more.