Sponsored by
✦
Happy Monday, legends. 🕶️ Hope your passwords are stronger than your coffee.
A quick heads-up: we’re winding this newsletter down and sending less often. Thank you for reading and making us part of your week. We’d love to see you over at Untangled, where we explore the tech we use every day; especially what we watch and listen to, and the weird decisions behind what’s getting better, what’s still broken, and what’s worth your attention.
Now, onto today’s news.
On Oct 30, Chainalysis told customers it had found no evidence that anyone took their login tokens. Five days later, it said tokens for every user had been exposed. The reassurance went out before the checking was done. At Salesforce, security is the one diligence team that can kill an acquisition, and it runs its own break-in test (once landing in a target CEO's laptop). Airbnb had independent directors approve its CEO's AI-lab deal before anyone asked. Either way, someone is going to check, and it's better if that someone is you. If a buyer tested your company this week, what would they find?
In today's newsletter, we'll get into:
The hacker trackers who got hacked
A $500M offer for a 3-year-old startup
The screensaver that walked away from Fox
Airbnb's CEO and his side AI lab
✦
The founder’s dashboard / Your quick roadmap
✦
FOUNDER BOARD
🔐 Salesforce's M&A chief says security is the one of 14 diligence teams that can kill a deal, so pen-test yourself first and show attrition, not just ARR.
🤖 Vercel's best SDR reviewed every output of its lead agent for six weeks until she found nothing to fix; after 30 workflows got that treatment, quotas rose 30%.
🎯 General Catalyst led 9+ US rounds in October ($5.1B combined) and Lightspeed led 8, so build your pitch list from who's actually leading, not who's famous.
🤝 Before asking for a discount, try "If we can do this, can you do that?", one of five lines in a negotiation script built on trades.
🌍 One agency founder hired 7 people in 6 countries with $0 in job ads by posting in niche Reddit communities with an intake form instead of resumes.
Untangled
Vizio once made over twice as much profit from ads and viewer data as from selling TVs. Your TV isn't the product. You are. Road gadgets and TV hacks in this week's Untangled.
✦
RUSHIN' ROULETTE
Five bullets of updates
📉 AI token spend grew just 1.5% across August and September, per corporate-card company Ramp, after jumping 42% in July alone. Usage keeps rising, but OpenAI and Anthropic price cuts have made it, in Ramp economist Ara Kharazian's words, a buyer's market, so the median firm's $12–$15 per employee per month is worth renegotiating before your next renewal.
🛡️ Palo Alto Networks is in talks to buy Clutch Security, a three-year-old startup that controls what AI agents can reach inside a company, for $500 million in cash plus milestone payouts. Clutch is nearing $10 million in ARR and was valued at $85 million last January, so the offer is about 50 times its revenue, which is the kind of multiple strategic buyers pay and VCs don't.
🐠 Artist Jim Sachs pulled his Aquatic Life screensaver from Roku, an $80,000-a-year license and his main income, because Fox was buying the company. The deal renewed every October and either side could cancel it for any reason, so a new owner was all it took; if one customer pays most of your bills, know exactly how it can leave.
🏠 Airbnb disclosed that CEO Brian Chesky's AI lab, in which its CTO also holds a stake, paid it $7.1 million for some IP and expenses, and Airbnb can join the lab's future rounds. Independent directors signed off under Airbnb's related-party policy, the rules for deals with your own insiders, so paper any side venture that way before an investor asks.
📱 Apple says more than 100,000 apps are now built for the iPhone Duo, its new foldable, two weeks after it went on sale. The badge doesn't promise much: Instagram launched looking messy despite its "Made for iPhone Duo" label, and its chief Adam Mosseri called the Duo "a bit of a tricky form factor," so test your app on one before users do.
✦
SPONSOR
The voice-to-text app that built its own speech model
Most dictation apps are a wrapper around someone else's speech model. Wispr Flow trained its own.
It's called Canto, and it was built for the way people actually talk to AI: thinking out loud, changing direction mid-sentence, half-whispering in an open office.
Wispr tested it on 10 hours of real dictations from more than 2,300 speakers. Canto had the lowest word error rate of every model tested, including models from Google, OpenAI, AssemblyAI and Deepgram. That means your prompts to ChatGPT, Claude and Cursor come through the way you said them.
Talk naturally in any app and Wispr Flow types clean, formatted text, 4x faster than typing.
✦
STARTUP NEWS
Hackers grabbed live login tokens for every Chainalysis user
Giphy
The company that helps the FBI follow stolen crypto now has to follow its own trail. Chainalysis said last Wednesday that names, usernames, password hashes and live tokens for all of its users were exposed to an attacker. Its customers include the FBI, the US Air Force, Microsoft and Coinbase, per Ars Technica.
Crypto's bloodhound: Chainalysis traces crypto transactions; exchanges wire its real-time screening tool, KYT ("know your transaction"), straight into their systems. A password hash is a scrambled copy of a password. A live token is a digital key that keeps you logged in, or lets software call an API with no password.
How did "non-sensitive" become "everyone"? Per the company's own incident log:
October: an attacker used what Chainalysis calls "offensive agentic techniques," meaning AI agents, to get into its systems.
Oct 30: it told customers only "non-sensitive" data like names and emails was accessed, with no evidence of stolen credentials or session tokens.
Nov 2: it found the hashes and tokens were exposed for every user.
Nov 4: after spotting "abnormal activity," it pulled its login page and KYT offline, and disclosed the Nov 2 finding, two days after making it.
Nov 6: access began returning, with mandatory password resets and API-key rotation.
Five days of comfort: the intrusion did the damage, but the Oct 30 email shaped what customers did next. Anyone who read "no evidence" had little reason to rotate keys until Nov 4.
No token gestures: a vendor holding a live token into your systems holds a key to your house. This week, list every third party with API keys into your product, check you can rotate each one fast, and draft your breach email now. Just don't write "no evidence" until you've finished looking.
Looking ahead… Chainalysis says there's no sign its investigation data was touched. Still open, per Ars: how the AI agents worked, and what made possible a separate "on-path" attack, which exposed some passwords by reading traffic between two systems.
✦
STARTUP TV
The Weird (but Exciting) State of Startup Funding
✦
FOUNDER BRIEF
What founders clicked on most in recent issues
🎣 Binance says hackers used a fake job interview to help steal $6.3 billion in crypto.
Co-CEO Richard Teng told CNBC the attackers posed as recruiters and ran job interviews with a Binance engineer in September. The final coding exercise hid malware, and from there they worked through internal AI tools to the system approving wallet transactions.
🏆 Microsoft opens its Imagine Cup to startups, with $250,000 in cash for the winner.
Entrants can now use any AI model they like, as long as it runs on Azure, after years of requiring Microsoft's own AI. Final judges will score net revenue retention, traction and a customer reference, and applications close Feb. 28.
📈 Anthropic booked $16.96 billion in third-quarter revenue, up 47% from the quarter before.
SaaStr's read of its amended IPO filing shows Q3 added $5.4 billion, less than Q2's $6.8 billion. It has also committed about $895 billion to future spending, mostly compute.
🔎 Investor Martin Tobias heard about 4,500 pitches last year and wrote just 10 checks.
His new tool, Investor Match, ranks 20 investors by fit from your pitch deck for $20. Founders say they've raised over $100 million through it, which Tobias says he can't verify.