Also for the reader
This guy has no way of knowing how many IP addresses chain analysis was able to get (if any) as a result of the Moneroworld reverse proxy malicious nodes.
To sum up:
CA is running malicious nodes.
They had succeeded in compromising and redirecting DNS records of a trusted but poorly maintained service to point to them. The above wallets listed those some of thiser nodes as options in their default node list.
Users sending a tx through those malicious nodes had the true input (a stealth address) to their transaction identified. And if they weren't connecting through a proxy their IP address.
Obviously less information then what would be leaked if you were connecting to a malicious Bitcoin node.
heres the video where CA breaks down the data. its good to be aware of the dangers and see their capabilities.
which are frankly minimal.
just use a proxy and connect to a trusted node.