Low-latency transmissions over Tor can be defeated with a timing attack if you're connected to several of the attacker's nodes and the attacker is watching your transmissions at your ISP.
The attacker can relay only blocks that he/she creates, putting you on a Bitcoin fork (separate from the main chain). After that you would be open to double-spending attacks.
Monitor the network hash rates closely. If they are unusually low then you should be careful you are not an a fork created by a sybil attacker, targeting Tor users.
Potential deonimation of metadata is probably a larger threat than a sybil attack if you are waiting for multiple confirmations and monitoring network hash rates
"Consider the following case. A client uses the same
computer for sending both benign Bitcoin transactions and
sensitive transaction. For benign transactions the user connects
to Bitcoin directly, but for sensitive transactions he forwards
his traffic through a chain of Tor relays or VPNs. If an attacker
implements the attack described in section III, all client’s
sensitive transactions with high probability will go through
attacker’s controlled nodes which will allow her to fingerprint
the user and record his transactions.
When the client later connects to the Bitcoin network
directly to send benign transactions, he will with some probability
choose an entry node controlled by the attacker (in
section V we show how to increase this probability). Once it
happens, the attacker can query the client for the fingerprint
and thus correlate his sensitive transactions with his IP address.
Note that even if the attacker is not implementing the complete
man-in-the-middle attack on Tor, but just injects Sybil peers
and Sybil hidden services he will be able to link many sensitive
transactions to the real IP addresses of the users."
The risk here can be limited by never accessing Bitcoin over Tor and clearnet from the same computer. Accessing Tor via a virtual machine over public WIFI can also help reduce your risk of being deanonymized.