In a plot that feels more like the screenplay of a corporate thriller than a courtroom reality, two of Silicon Valley’s most celebrated HR tech unicorns—Rippling and Deel—are now locked in a high-stakes legal war involving secret communications, crypto payments, deleted devices, and an ex-employee turned whistleblower.
At the heart of the unfolding scandal is a detailed affidavit from a former Rippling employee, Keith O’Brien, who claims he was paid by Deel’s leadership to act as a corporate spy. His testimony, supported by internal records, conversations on encrypted messaging apps, and even a fake Slack channel trap, has escalated a simmering rivalry into one of the most spectacular corporate espionage allegations in recent tech history.
The Setup: When a Failed Job Interview Turned Into an Espionage Offer
Keith O’Brien joined Rippling’s Dublin office in July 2023, working in payroll compliance. In early 2024, he interviewed for a role at Deel—but didn’t get the job. Still eager to connect, he reached out to Deel CEO Alex Bouaziz via LinkedIn.
What came next was the moment the narrative diverged from normalcy. O’Brien, seeking partnership for a consulting firm he launched later that year, claimed that Alex offered him a different kind of proposition: stay at Rippling and act as a spy.
“Like James Bond,” Alex reportedly said during a call, according to the affidavit.
O’Brien agreed within 30 minutes via WhatsApp. What followed was a secret intelligence-sharing relationship, with daily communication via Telegram—set to auto-delete messages—and payment in crypto.
Crypto, Codewords, and “The Watch”
From September 2024 onward, O’Brien’s covert work escalated.
His espionage tasks included:
Accessing Slack, Salesforce, and Google Drive data
Sharing sales leads, product roadmaps, top-performing employees
Monitoring customer demos involving Deel competitors
Using keyword searches like “iran”, “sanctioned countries”, “tinybird”, and even “tom brady” at Deel’s request
All communication with Alex and Deel’s COO Dan Westgarth occurred via encrypted Telegram channels. Deel’s CFO Philippe Bouaziz—Alex’s father—handled the payment logistics.
The Payment Scheme:
First payment: $6,000 via Revolut (from Dan Westgarth’s wife)
Subsequent payments: Monthly €5,000 (~$5,400), paid in Ethereum (ETH)
Code: O’Brien would send a photo of a watch, Philippe would respond “send the watch to London,” followed by “the buyer is happy”
O’Brien stored screen recordings up to six minutes long, some of which were unintentionally backed up to his iCloud—later becoming key evidence.
The Trap: Slack Channel “#d-defectors” and the Moment of Exposure
In February 2025, Rippling suspected an internal breach. To confirm it, they devised a clever honeypot: a fake Slack channel named “#d-defectors,” seeded with the suggestion that sensitive info damaging to Deel was being discussed.
Rippling’s legal team sent Deel a letter referencing the channel—knowing it didn’t contain real content.
Within minutes of receiving the hint, O’Brien, acting on Alex’s instructions, searched the channel. Just minutes later, Alex messaged:
“Oh shit.”
The trap had worked. Rippling confirmed the breach using Slack access logs. O’Brien had exposed himself.
Escape, Data Deletion—and an Axe
On March 14, 2025, O’Brien was summoned to Rippling’s Dublin office under the pretense of collecting a “compliance award.” Instead, he was met by a solicitor with a court order to inspect his devices.
He surrendered his work laptop—but claimed he left his phone elsewhere. In reality, he hid the phone in his jacket, retreated to a bathroom, and performed a full factory reset.
After leaving the building, he contacted Deel’s legal contacts via Telegram. Over the next 48 hours, they gave him increasingly desperate advice:
“Delete Telegram. Buy a burner phone.”
“Smash your old phone.”
“Relocate to Dubai.”
He followed through. He destroyed his previous iPhone with an axe, threw the fragments into a drain at his mother-in-law’s house, and deleted his LinkedIn account.
The Dubai Plan & False Whistleblower Story
According to the affidavit, Deel’s in-house counsel Asif Malik, and another executive named “David,” advised O’Brien to:
Claim that Rippling violated U.S. sanctions by processing Russian payments
File complaints with the Central Bank of Ireland
Assert that he was being persecuted for “whistleblowing”
They provided him with draft documents, coordinated communications, and suggested he move to Dubai with his family to avoid potential extradition.
“I knew the accusations were false,” O’Brien later testified.
“But I was told they were my only protection.”
The Turning Point: Guilt, Anxiety—and Truth
By March 26, O’Brien’s anxiety had reached a breaking point.
He reached out to Rippling’s legal team and confessed. On March 28, he surrendered his remaining devices and became a cooperating witness.
In a later statement, he wrote:
“I was harming myself to protect Deel. I wanted to make things right.”
Parker Conrad Speaks, and the Internet Erupts
On April 2, 2025, Rippling CEO Parker Conrad went public.
He shared parts of the affidavit in a viral X (formerly Twitter) thread, stating:
“We caught a spy. The evidence is undeniable. The top of Deel’s leadership is implicated. And yes—they even told him to move to Dubai.”
His thread received millions of views within hours. Screenshots of O’Brien’s messages, photos of smashed devices, and quotations from the affidavit became instant tech Twitter lore.
Elisabeth Diana Exits Amid the Storm
On April 5, it was revealed that Elisabeth Diana, Deel’s Head of Communications and a former top comms executive at Facebook and Instagram, had quietly left the company.
According to her LinkedIn, she ended her tenure in April 2025, after nearly 3.5 years.
Deel issued a brief statement:
“We are grateful for the work Elisabeth did while at Deel and wish her the best in her next endeavor.”
No official link was drawn to the lawsuit—but the timing raised eyebrows across the industry.
Industry Response and Public Backlash
The case sparked immediate and widespread reaction:
Papaya Global CEO Eynat Guez tweeted:
“As far as we know, this is not a one-off incident. Thank you @parkerconrad for taking the initiative and ending this practice.”
Multiple VCs privately expressed concern over Deel’s IPO readiness.
Analysts and journalists called this “Silicon Valley’s most destructive founder scandal since Theranos.”
Deel, last valued at $12.6 billion, remains under intense scrutiny. The company has denied all allegations and announced it will file counterclaims.
Legal Fallout
U.S. Federal Court (San Francisco):
Allegations include:
Violation of RICO (Racketeer Influenced and Corrupt Organizations Act)
Trade secret misappropriation
Unfair competition
Ireland (High Court):
Rippling filed additional complaints for:
Obstruction of justice
Evidence destruction
Malicious legal interference
Deel maintains that Rippling is attempting to “shift the narrative” away from its own legal challenges.
What’s at Stake?
This is no longer just a corporate rivalry—it’s a trust crisis for the HR tech industry.
With AI-powered global employment platforms handling sensitive employee data across jurisdictions, the idea that a unicorn startup may have planted a spy inside a rival using crypto and burner phones sends chills across the boardrooms of tech startups.
"If this is true," one HR tech CEO told us off-record, "we’re not talking about growth anymore. We’re talking about governance and survival."
Final Words
This saga is far from over. But one thing is certain: The boundaries between aggressive business intelligence and illegal espionage are now being redrawn—in full public view.
And all it took was a fake Slack channel and a smashed iPhone.
Sources & References
Keith O’Brien Affidavit (Filed in High Court of Ireland, April 1, 2025) https://rippling2.imgix.net/Complaint.pdf
Parker Conrad’s X thread (April 2, 2025): https://x.com/parkerconrad/status/1907444819598999622
Bloomberg & TechCrunch reporting (April 2–5, 2025)
LinkedIn Profile: Elisabeth Diana
Deel and Rippling Official Statements
Legal Disclaimer
This article is based on publicly available legal documents, including a sworn affidavit filed in the High Court of Ireland, as well as verified reporting from reputable media outlets such as Bloomberg and TechCrunch. All claims and quotes attributed to individuals or organizations are derived from these sources or their official public communications as of April 6, 2025. Deel has formally denied all allegations related to this case and has stated its intention to pursue counterclaims. The purpose of this article is to inform readers of developments within the global HR tech industry and does not constitute legal judgment or endorsement of any party’s position.
Subscribe to our newsletter and never miss our latest digital HR news！
By signing up to receive DHRmap newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe anytime.
We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.
Back
X.com
