Hackers steal Bitcoin through large-scale exploit on Tor (decrypt.co)

Why are sites handling transactions even offer http in the first place?