I’m on multiple private trackers, and they all hosted the infected version (they’ve been taken down now). Private doesn’t make it safe, especially when people are using automated tools to be the first to upload a torrent.