[xnull]

Six digits sounds about right for a Tor bug for one target depending on the specifics. The RCE bug used by the FBI recently against the Tor Firefox Bundle would have cost something similar, though the payload suspended the process where it could have resumed silently. It's not clear where that exploit was developed (my gut says in house but who knows?)

[sarciszewski]

IIRC someone analyzed the payload and compared it to a Meterpreter and saw a lot of similarities. Could have been provided (hacked together?) by the person who sold the vuln.