S&P Global Agrees to Acquire OpenZeppelin

S&P Global said on Sept. 17, 2026 it had entered an agreement to acquire OpenZeppelin, the smart contract security company whose open source code underpins much of the stablecoin and tokenized fund market. CoinDesk reported the deal on Sept. 17, citing the morning announcement. Financial terms were not disclosed, the company said in its press release.

The buyer put the scale of that code base in its announcement. Contracts built with the OpenZeppelin library have moved more than $37 trillion in value over time, according to the release. CoinDesk put the same $37 trillion figure at the center of its account of the deal. The number counts cumulative transfers through contracts that use the library, not assets that OpenZeppelin holds or manages.

"Our digital assets strategy centers on bringing trusted data, benchmarks and transparent risk assessment to markets as they move onchain," S&P Global Ratings President Yann Le Pallec said. The quote appeared in the announcement alongside the deal terms. Le Pallec added that OpenZeppelin technology and staff would add to the company's smart contract and onchain technology risk work, giving banks and crypto native companies more confidence to build and trade in the market.

The logic of the purchase sits in the gap between balance sheet risk and code risk. A stablecoin or tokenized fund can hold sound reserves and still lose money through a flaw in the contracts that mint, move and settle the tokens. S&P is betting that banks and asset managers will want shared methods for judging that code risk before they use onchain products at scale, CoinDesk wrote in its analysis of the deal. The acquisition gives the ratings company a direct view into that technology layer.

Founded in 2015, OpenZeppelin sells security reviews and secure development services and publishes one of the most used open source smart contract libraries. Its contracts sit behind many of the largest stablecoins and tokenized funds. The company has carried out more than 900 security reviews for protocols and institutions active in digital asset markets, the release says. Those reviews surfaced more than 10,000 weaknesses before the code reached production, the account adds.

"OpenZeppelin's standards, technology, and expertise already power the infrastructure behind the world's leading stablecoins, tokenized funds, DeFi protocols, and onchain markets," OpenZeppelin co-founder and chief executive Demian Brener said. His remarks came in the same release. Brener said the S&P combination would carry that base to a wider group of organizations entering the market, including blockchain networks and DeFi protocols drawing institutional use.

The unit will keep its name after the sale closes. Brener will continue to lead the business as a separate unit under the OpenZeppelin name, reporting to Le Pallec. That reporting line places the security team inside the ratings organization while leaving its brand intact. The two companies framed the setup as a way to sell code risk analysis through S&P's existing ties to banks and asset managers.

The transaction remains subject to closing conditions. The parties did not name a closing date. S&P said the purchase is not expected to have a material effect on its financial results, according to the release. Until the conditions are met and the deal closes, OpenZeppelin continues to operate on its own.

Advisors on the two sides were named in the announcement. Jefferies served as financial adviser to S&P Global and Clifford Chance acted as its legal adviser. FT Partners served as exclusive financial and strategic adviser to OpenZeppelin and Cooley acted as its legal adviser, the release lists. The roster follows the usual pattern for a private company sale to a listed buyer.

The deal extends a digital asset program S&P has built over more than a year. The company publishes stability assessments for stablecoins and last year issued its first credit rating of a DeFi protocol when it rated Sky. That ratings history shows the move from judging issuers to judging the code those issuers run on. OpenZeppelin shifts that work from the entity to the software underneath it.

Two days before the acquisition, S&P led a strategic investment that extended crypto data company Kaiko's Series B round to $110 million. BNP Paribas, Nasdaq Ventures, Coinbase Ventures and Royal Bank of Canada joined the round. The Kaiko round added market data to the ratings company's digital asset holdings. Earlier in September, S&P Dow Jones Indices and Kaiko started a co-branded digital asset index suite, and in March the pair put the iBoxx U.S. Treasuries Index onchain.

The $37 trillion claim needs a plain reading. It sums the value that has passed through contracts using OpenZeppelin code since the library began to spread, across stablecoins, funds and trading protocols. It does not mean OpenZeppelin custodies those funds or earns fees on each transfer. That distinction matters because the purchase price buys talent, software and review methods rather than assets under management.

For banks, the pitch is a single vendor for two kinds of diligence. S&P already rates creditworthiness, reserves disclosure and governance for digital asset issuers. OpenZeppelin adds reviews of the programs that control minting, redemptions, access rights and upgrades. A fund can pass the first set of checks and fail the second when an admin key is too broad or a lending pool misprices collateral, as the deal rationale explains. Paired ratings would let an investor see both sides before allocating.

For DeFi teams, the change is distribution more than method. OpenZeppelin reviews and library releases would continue, but through a parent with long ties to regulated asset managers and global sales channels. The announcement frames that reach as a way to speed institutional adoption of onchain markets. Protocol teams seeking bank deposits or collateral status could point to assessments written in a form that credit committees already use.

S&P described the aim as new onchain security assessments, benchmarks and market intelligence for a period in which more of capital markets moves onto blockchains. The release uses that language to connect the purchase to its wider data business. The company, valued at roughly $120 billion, has added data, indices and now code review to its digital asset shelf in the same month.

What remains undisclosed is as concrete as what was announced. The price and payment form were not published. Retention terms for OpenZeppelin staff were not published. The length of the closing process and the regulators or approvals involved were not spelled out beyond the reference to closing conditions. Those gaps leave the near term structure of the combined unit unclear until the parties file more.

The next formal step is closing. S&P and OpenZeppelin must satisfy the conditions in the agreement before ownership passes and the reporting line to Le Pallec takes effect. Neither side has set a public date for that handover. The acquisition agreement is signed, the price is private, and the integration plan waits on the close.