S&P Global to Acquire OpenZeppelin, Betting Ratings Business on Onchain Risk
S&P Global agreed to acquire OpenZeppelin, the smart-contract security firm whose open-source code libraries underpin much of the infrastructure behind major stablecoins and tokenized funds, as the ratings giant builds out risk-assessment tools for onchain markets.
NEW YORK — S&P Global said it has agreed to acquire OpenZeppelin, a smart-contract security firm whose open-source code library the companies say underpins more than $37 trillion in value transferred, including the infrastructure behind many of the largest stablecoins and tokenized funds. The companies did not disclose financial terms of the deal, which was announced Sept. 17.
OpenZeppelin, founded in 2015, occupies an unusually load-bearing position in crypto infrastructure for a company most consumers have never heard of: its OpenZeppelin Contracts library is a widely reused set of audited, open-source building blocks that other developers plug into their own smart contracts rather than writing equivalent code from scratch, and its security team has run more than 900 audits that the company says have surfaced over 10,000 vulnerabilities before those contracts went live. S&P Global framed the acquisition as extending its existing ratings and risk-assessment business into what it called the "onchain technology-risk layer" — assessing not just an issuer's financial soundness but the security of the code its financial product actually runs on.
The logic mirrors a bet several traditional financial-infrastructure firms have made this year: as stablecoins, tokenized funds and other onchain instruments move from crypto-native platforms into products traditional institutions distribute and hold, the market for independent, trusted risk assessment of the underlying smart-contract code becomes a distinct business from assessing the issuer's balance sheet. Yann Le Pallec, president of S&P Global Ratings, said the deal is meant to give both DeFi-native companies and traditional financial institutions "the confidence to build and transact" as digital assets and tokenized markets mature — pairing S&P's existing institutional distribution and brand with a technical security capability it did not previously have in-house.
S&P Global did not say whether OpenZeppelin will continue operating its open-source library and existing client audits independently or how quickly its risk-assessment work will be folded into S&P's ratings products, and the deal remains subject to customary closing conditions the companies did not detail. The acquisition's significance will depend largely on execution neither company has yet made public: how a ratings-industry compliance and disclosure culture interacts with a security firm whose core product has, to date, been open-source and community-audited.