According to this site Ashley Madison was keeping an insecure hash stored in their database using MD5, in addition to the far more secure bcrypt hash. This group used the MD5 hashes to quickly crack the password database rather than use the far more difficult to crack bcrypt hashes.
The article only gives this brief clue:
The $loginkey variable seemed to be used for automatic login, but we didn’t spend much time investigating further. It was generated upon user account creation and was re-generated when the user modified their account details including username, password and email address.
The question is, what's the purpose of this $loginkey variable? It's obviously pointless to use bcrypt which is purposefully slow when you're using a far, far faster hash like md5 elsewhere that's an easier target. Obviously this is a large blunder on the part of the Ashley Madison developers, but I'm curious as to why they would have put this in in the first place, and why it was never fixed since (someone) knew to use bcrypt for the main password hash.