S&P Global to Acquire OpenZeppelin: Crypto Security Joins the Ratings Business

S&P Global has agreed to acquire OpenZeppelin, a developer of smart contract libraries. According to the company, its code has secured more than $37 trillion in transactions and passed over 900 security audits. The deal was announced on September 17, 2026, and the financial terms were not disclosed.

For S&P Global, known mainly for credit ratings and financial indices, this is already the second crypto deal this week. Days earlier the company led an investment round in the Paris-based startup Kaiko, pushing its Series B to $110 million.

What the Ratings Giant Is Actually Buying

OpenZeppelin was founded in 2015. The company writes open-source code for smart contracts on Ethereum and compatible networks, and runs paid security audits for blockchain projects and financial institutions. Its libraries have become an industry standard: developers plug in ready, tested modules instead of writing code from scratch, which lowers the risk of vulnerabilities.

By the company's own count, more than $37 trillion in value has passed through these libraries. The figure covers transfers in stablecoins, tokenized funds and DeFi protocols on networks such as Solana and Cardano.

Beyond the code itself, the company builds tools around it. Contracts Wizard helps developers assemble secure contract templates without deep Solidity knowledge, while the Defender platform watches contracts after launch and reacts to suspicious activity. OpenZeppelin's client list includes teams behind protocols such as Compound and Aave, which is why the company has long been part of DeFi's core infrastructure rather than just another vendor.

Where It Fits Inside S&P Global

OpenZeppelin will operate as a separate unit within S&P Global. Its CEO, Demian Brener, will stay in charge of the business but will report to Yann Le Pallec, President of S&P Global Ratings. The open-source library and the rest of the free tools will remain public on GitHub, while audits and risk assessments for institutional clients will become the paid side of the business.

Keeping the base code free was not an accident. Years of open access built developer trust and turned the company into an unofficial industry standard. By the look of it, S&P Global does not plan to change that: only audits, consulting and products for institutions will become paid, while the foundation stays open to any developer.

"As digital assets and tokenized markets continue to mature, OpenZeppelin's technology and expertise will complement our smart contract and onchain technology risk assessment capabilities, giving traditional financial institutions and DeFi-native companies alike the confidence to build and transact in this new environment."

- Yann Le Pallec, President, S&P Global Ratings, from the company's official statement, September 17, 2026

The Second Deal in a Week

Buying OpenZeppelin does not look like an isolated move. Earlier the same week, S&P Global led a strategic round in Kaiko, a Paris-based crypto market data provider. Together, both deals point to one pattern: the ratings giant is building its own infrastructure for assessing onchain risk instead of buying data from outside vendors.

Kaiko collects and vets trading data from dozens of crypto exchanges, then sells the resulting datasets to banks, funds and regulators that need reliable benchmarks for pricing and indices. Without solid market data, it is hard to build ratings or benchmarks that institutional clients trust, which makes the asset valuable to S&P Global on its own.

Where Institutional Capital Is Heading

The deal fits a broader trend. BlackRock has already launched tokenized money market funds on the Solana and Ethereum networks, while the SEC opened an exemption allowing tokenized US stocks to trade on public blockchains without registering as a national exchange. S&P Dow Jones Indices, for its part, built the S&P Digital Markets 50 Index, which combines 35 blockchain-related stocks with 15 cryptocurrencies.

A similar shift is happening in settlement infrastructure. USDC issuer Circle recently launched its own blockchain, Arc, built specifically for stablecoin settlement among banks and fintech firms. Every new rating product, index or settlement network ultimately rests on the same layer, the smart contract code, which is exactly why reviewing it has turned into a standalone business rather than a side service.

At the same time, banks are testing tokenized deposits and stablecoin settlement as working products rather than lab pilots. Every such launch raises the same question. Who is responsible if a bug turns up in the contract code?

• Banks and asset managers are moving parts of their products onto blockchain networks and need independent assessments of the technical risks.
• Code audits: without smart contract reviews, institutional capital rarely enters DeFi protocols.
• Rating agencies are competing for the role of trust provider in tokenized markets, not just traditional bonds.
• Stablecoins and tokenized bank deposits need the same level of code review as traditional DeFi protocols.

Fallout for the Smart Contract Audit Market

For OpenZeppelin, the deal brings access to S&P Global's client base and reputation among banks and regulators who previously trusted pure-play crypto companies less. For the rest of the smart contract auditing market, it signals that large ratings and financial players would rather buy established teams than build expertise from scratch.

There is a flip side to this consolidation. When one large company controls smart contract risk assessment, the market gets fewer independent voices, and a mistake or biased call from a single auditor can affect dozens of protocols at once.

Over the coming months, it will be worth watching whether S&P Global's rivals follow suit, for example Moody's and Fitch. Both agencies already run digital units, though mostly through partnerships so far rather than acquisitions.