Opsec breaches here: (from https://www.vg.no/spesial/2017/undercover-darkweb/, linked in this thread)

1. not firewalling the server so all traffic goes through Tor

2. registering a bitcoin wallet with a private email address

3. asking a coding question using their own identity (Ross Ulbricht, anyone?)