S&P Global Acquires OpenZeppelin to Extend Risk Coverage to Smart-Contract Code

S&P Global has agreed to acquire OpenZeppelin, a smart-contract security firm whose open-source library underpins a significant share of the stablecoin and tokenised-fund market. Contracts built with OpenZeppelin’s code have facilitated more than $37 trillion in cumulative value transfers, though that figure reflects historical throughput rather than assets under management. Financial terms were not disclosed, and the deal remains subject to closing conditions.

The strategic logic is an extension of coverage rather than a pivot: S&P’s existing digital-asset work centres on issuer creditworthiness, reserve adequacy, and protocol-level ratings, most recently including the first credit rating of a decentralised finance protocol, Sky. OpenZeppelin adds a layer that conventional ratings do not reach, namely the security of the code itself. A tokenised fund or stablecoin can carry a sound credit profile while remaining exposed to vulnerabilities at the contract level, and S&P is positioning to assess that gap systematically through benchmarks and onchain security assessments.

OpenZeppelin will continue to operate under its own name as a distinct unit, with co-founder and chief executive Demian Brener remaining in place and reporting into S&P’s structure. The acquisition follows a sequence of digital-asset moves by the roughly $120 billion company: earlier in September S&P Dow Jones Indices and Kaiko launched a co-branded digital-asset index suite, and in March the two tokenised the iBoxx U.S. Treasuries Index. On the same week as this announcement, S&P led a strategic investment extending crypto data firm Kaiko’s Series B to $110 million, joined by BNP Paribas, Nasdaq Ventures, Coinbase Ventures, and Royal Bank of Canada.

For banks and asset managers building onchain product programmes, the acquisition signals that smart-contract security audit history and vulnerability disclosure are moving toward the kind of standardised, third-party assessable framework that compliance functions expect before scaling exposure. OpenZeppelin’s record of more than 900 security engagements surfacing over 10,000 pre-production vulnerabilities gives S&P a proprietary dataset from which to build those benchmarks, which is the part of this deal worth watching as closing conditions are satisfied.