S&P Global agreed Thursday to acquire OpenZeppelin, the blockchain security firm whose open-source smart contract libraries underpin much of the tokenized asset market. The deal, announced as the SEC opens the door to tokenized stock trading, signals that established financial data providers are positioning for a market where banks need to assess code risk the way they assess credit risk.
Financial terms were not disclosed. The transaction remains subject to closing conditions, and S&P Global said it is not expected to have a material impact on its financial results. OpenZeppelin will operate as a distinct business unit, with CEO Demian Brener continuing to lead it and reporting to S&P Global Ratings president Ian Le Pallec.
“S&P Global’s strategy focuses on providing reliable data, benchmarks, and transparent risk assessments as markets transition on-chain,” Le Pallec said in the announcement. He added that OpenZeppelin would expand the company’s ability to assess smart contract and onchain technology risks.
What S&P is buying
OpenZeppelin, founded in 2015, is best known for OpenZeppelin Contracts, a library of audited smart contract components that has become default infrastructure for Ethereum and other chains. According to the announcement, contracts built on its libraries have secured more than $37 trillion in asset transfers, and the company has completed more than 900 security engagements for protocols, financial institutions and other digital asset organizations. Those audits identified more than 10,000 vulnerabilities before production.
The company’s technology is already embedded in infrastructure supporting major stablecoins, tokenized funds, decentralized finance protocols and blockchain networks. When a bank issues a tokenized fund or a payment company moves dollars over a public chain, there is a reasonable chance the contract code traces back to OpenZeppelin’s library.
The firm has about 125 employees and offices in London and San Francisco. It was venture backed, with investors including Intersection Growth Partners, Northzone and IDEO CoLab Ventures, and raised through a series of rounds from 2015 through a secondary transaction in late 2025.
Why a ratings company wants a security auditor
The logic of the deal runs through the tokenization wave now reaching capital markets. Hours before the acquisition was announced, the SEC issued its innovation exemption for tokenized stock trading, and US banks and asset managers are building tokenized funds, collateral systems and settlement rails. Every one of those products runs on smart contracts, and a flaw in that code can drain a fund in minutes rather than quarters.
Traditional risk assessment does not cover this. A rating agency can model default probability and cash flows, but it cannot easily judge whether a smart contract’s access controls can be exploited. By owning OpenZeppelin, S&P Global brings that capability in house and can bundle code-level security assessment with its data, benchmarks and ratings, selling a single risk picture to institutions entering onchain markets.
The acquisition also extends S&P’s earlier moves into digital assets, including a market-data investment in Kaiko. The company described the pattern as building capabilities across the stack as financial institutions increase their use of tokenized assets and onchain infrastructure.
For OpenZeppelin, the trade is distribution. The security firm gains access to S&P Global’s institutional relationships, brand and global reach at a moment when its natural customers, established financial companies, are finally arriving in volume. A two-way expansion sits at the core of the deal: S&P gets specialized blockchain security technology, and OpenZeppelin gets a sales channel into firms that would never have hired a crypto-native auditor on their own.
What stays open source
A recurring worry in acquisitions of open-source companies is what happens to the free code. S&P Global and OpenZeppelin addressed it directly: the OpenZeppelin Contracts library and other open-source applications will remain free and continue to be publicly maintained on GitHub. That matters beyond goodwill. Thousands of projects, including some of the largest stablecoins and DeFi protocols, depend on the library, and a closed or neglected version would have created a security problem across the industry.
The commitment also preserves the library’s role as quasi-standard infrastructure. If S&P Global tried to gate it, competitors and the developer community would likely fork it within weeks, leaving the company with a proprietary codebase nobody uses and a reputational cost in the developer ecosystem it now needs.
Context and what comes next
The deal lands in a busy week for crypto regulation and infrastructure. The SEC’s tokenized stock exemption, the Fed’s first rate hike since 2023 and continued institutional launches, including Circle’s Arc blockchain and Broadridge’s tokenization platform, have pushed onchain finance from pilot projects toward production systems. Security is the obvious bottleneck: more institutions touching more contracts means more attack surface, and the industry has already seen hackers drain millions from defunct DeFi protocols this year.
Closing conditions and regulatory review remain, though a deal of this size is unlikely to face extended scrutiny. Once closed, the practical test will be whether S&P Global can translate audit expertise into repeatable risk products, such as smart contract scores attached to tokenized funds or benchmarks for onchain infrastructure quality, without breaking the open-source culture that made OpenZeppelin credible in the first place.
For the tokenization market, the acquisition is another signal that the plumbing is being taken seriously by the same firms that rate bonds and index markets. Code risk is becoming a rated, priced input, and the company that supplies much of the underlying code now sits inside a ratings giant.