S&P Global agrees to acquire OpenZeppelin, bringing onchain security into traditional finance

S&P Global, one of the most powerful names in traditional finance, has agreed to acquire OpenZeppelin, the firm whose open-source code libraries quietly underpin a staggering portion of the blockchain economy.

The deal, announced on September 17, marks one of the clearest signals yet that legacy financial institutions aren’t just dabbling in crypto anymore. They’re buying the plumbing.

What S&P is actually buying

OpenZeppelin isn’t a flashy DeFi protocol or a memecoin launchpad. The company, founded in 2015, specializes in onchain security assessments and is best known for its Contracts library, a set of open-source smart contract templates that developers across the industry treat as the gold standard.

That library has facilitated over $37 trillion in value transferred across blockchain infrastructures. To put that in perspective, that’s roughly the annual GDP of the United States and Japan combined flowing through code that OpenZeppelin helped secure.

The company has completed more than 900 security engagements and identified over 10,000 vulnerabilities across various blockchain projects.

Under the terms of the acquisition, OpenZeppelin will operate as a standalone unit within S&P Global. CEO Demian Brener will stay on and report to Yann Le Pallec, the president of S&P Global Ratings. Financial terms were not disclosed, and S&P noted the transaction is not expected to materially impact its financial results. The deal remains subject to customary closing conditions. Jefferies and Clifford Chance advised S&P on the transaction, while FT Partners and Cooley represented OpenZeppelin.

Why a credit ratings giant wants blockchain auditors

S&P Global’s core business is telling the world which borrowers are trustworthy. It rates sovereign debt, corporate bonds, and structured financial products. As more assets get tokenized and more financial infrastructure moves onchain, the traditional risk assessment playbook needs new chapters. You can’t rate a tokenized bond without understanding the security of the smart contract that governs it.

OpenZeppelin gives S&P the in-house expertise to bridge that gap. Instead of building blockchain security capabilities from scratch, S&P is acquiring a team that has spent nearly a decade doing exactly this work for the crypto-native world.

Just three days before announcing the OpenZeppelin acquisition, S&P made a strategic investment in Kaiko, a digital asset data provider, on September 14. The two moves together paint a clear picture: S&P is assembling the toolkit it needs to become a credible authority on digital asset risk, not just traditional financial risk.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.