S&P Global Agrees to Buy OpenZeppelin as It Builds Onchain Infrastructure

S&P Global said on 17 September 2026 that it has entered an agreement to acquire OpenZeppelin, the open-source smart-contract security firm whose code libraries have helped move more than $37 trillion in value across blockchain networks since 2015, according to OpenZeppelin’s own announcement. Financial terms were not disclosed, and the deal remains subject to closing conditions, the company said. OpenZeppelin has carried out more than 900 security engagements and says it has flagged over 10,000 vulnerabilities before code reached production, the announcement states.

Yann Le Pallec, president of S&P Global Ratings, said in the announcement that the company’s digital-assets strategy centres on bringing trusted data, benchmarks and risk assessment to markets moving onchain, and that OpenZeppelin’s technology will complement S&P’s existing smart-contract and onchain risk work. OpenZeppelin, for its part, said its open-source contract libraries will remain free and publicly maintained on GitHub, and that every version already released stays open source permanently, regardless of who owns the company.

A pattern of moves into onchain markets

The OpenZeppelin purchase is the latest in a run of moves by S&P into digital-asset infrastructure this month. Three days earlier, S&P led a strategic investment that extended crypto data firm Kaiko’s Series B funding round to $110 million, with participation from DRW, Susquehanna, Nasdaq, BNP Paribas and Royal Bank of Canada, according to CryptoSlate’s reporting. Kaiko already supplies market data to more than 250 financial firms and connects to over 150 exchanges, the outlet reported. Earlier in September, S&P Dow Jones Indices folded its digital-asset benchmark work together with Kaiko’s into a joint index suite designed for markets that trade continuously, CryptoSlate reported, following on from a March project that put the iBoxx US Treasuries Index onchain.

Taken together, these deals give S&P a foothold across separate layers of onchain finance: Kaiko supplies pricing and market data, S&P’s own indices supply benchmarks, and OpenZeppelin supplies the code-security layer that determines whether a stablecoin or tokenized fund behaves the way its issuer claims, CryptoSlate reported. Crypto Times noted that S&P itself has stressed the $37 trillion figure describes cumulative value moved through contracts using OpenZeppelin’s technology over more than a decade, not money the firm holds or manages, and is not the acquisition price.

That distinction matters because the underlying business is genuinely different from traditional credit rating. A ratings analysis of reserves and issuer solvency has no mechanism for catching a coding flaw that lets a hacker drain a fund overnight, a risk Crypto Times said the acquisition is meant to help S&P assess directly. Bitcoin.com’s news desk described the purchase as a bet by the 158-year-old ratings firm on onchain finance becoming permanent, rather than a passing trend.

No regulator, public tender or consultation preceded the transaction, and S&P has not disclosed what it paid. A company that already rates sovereign debt, corporate bonds and structured products has now bought the firm whose open-source code underpins a large share of the world’s stablecoins and tokenized funds, without publishing a price or explaining what independent check, if any, will apply to its own judgment on code it did not originally write. That gap sits alongside an ongoing debate among central banks, including the Bank of Canada and the Bank for International Settlements, over whether only public authorities can be trusted with the plumbing of programmable money, even as the actual security layer for private stablecoins concentrates inside one commercial ratings group.