The traffic on the physical layer has to exit to the server housing the service though surely. The hidden service isn't distributed is it?

I read in another thread that they're reported to have hacked PHP to expose a vulnerability that gave them an admin IP address that was being allowed through the firewall. Seems reasonable.