S&P Global is pushing deeper into blockchain infrastructure with a deal for OpenZeppelin, the smart contract security company whose software and audit work sit under a large share of onchain development.
On Sept. 17, S&P Global said it had reached an agreement to acquire OpenZeppelin. Financial terms were not disclosed, and the transaction remains subject to closing conditions. Once completed, OpenZeppelin will continue operating as an independent business unit under its existing brand. CEO Demian Brener will remain in charge of the business and report to Yann Le Pallec, president of S&P Global Ratings.
For OpenZeppelin’s customers, the near-term setup is expected to stay largely the same. The company said OpenZeppelin Contracts and its other open-source applications and tools will remain free, open-source, and publicly maintained on GitHub. Its security audits, engineering services, and ecosystem programs will also continue to be handled by the current team.
More than an audit shop
Viewing OpenZeppelin only as a smart contract auditor misses the larger reason this deal matters.
Its business has two main sides. One is commercial security work for institutions and large protocols. The other is open-source infrastructure used across the broader blockchain developer ecosystem. Since its founding in 2015, OpenZeppelin says it has completed more than 900 security engagements and identified more than 10,000 vulnerabilities, including over 700 classified as high or severe.
Its client list extends well beyond crypto-native teams. Circle, Coinbase, Uniswap, Aave, BlackRock, Franklin Templeton, and WisdomTree have all used OpenZeppelin technology or security services, according to the company.
The bigger asset may be the way OpenZeppelin turned security work into widely adopted open-source infrastructure. Its flagship product, OpenZeppelin Contracts, has become a standard building block for onchain development. Developers use the tested and reviewed codebase to build token functions, access control systems, governance modules, upgrade mechanisms, and other smart contract features.
That code is already embedded in real financial applications. OpenZeppelin says Contracts now records more than 850,000 weekly downloads on NPM, more than 27,000 GitHub stars, and more than 300,000 dependent repositories. The company also says its smart contract libraries have supported more than $37 trillion in value transferred.
That makes OpenZeppelin less a niche crypto security firm and more a provider of security infrastructure for onchain finance. For S&P, that foundation appears to be the real target.
Why S&P wants it now
S&P Global’s own framing is direct: traditional finance is moving onchain, and the company wants a stronger grip on how risk is measured inside that new infrastructure.
S&P’s business reaches far beyond the ratings franchise most widely associated with its name. It spans credit ratings, indices, market data, research, and analytics. At its core, the company builds standardized tools that financial markets use to measure risk, price assets, and compare products.
Its digital asset push has accelerated in recent years. Just days before announcing the OpenZeppelin acquisition, S&P Global said it had led a new funding round for crypto market data company Kaiko. The two companies had already worked together on the S&P Kaiko Digital Asset Indices, and in March this year they brought the iBoxx U.S. Treasury Index onto blockchain rails in native digital asset form.
Seen together, those moves outline a clearer strategy. The Kaiko investment gives S&P a stronger position in onchain and digital asset data. Buying OpenZeppelin adds technical risk identification tied to the infrastructure itself.
For traditional institutions, the challenge is no longer limited to finding a way to tokenize assets. They also need to know how those assets should be priced, whether market data can be trusted, whether smart contracts contain vulnerabilities, and what technical risks sit in the underlying systems.
S&P Global said OpenZeppelin will help extend its risk assessment capabilities into the “onchain technology-risk layer” and support onchain financial products. In return, S&P’s institutional client base, market data, research capabilities, and global distribution network are expected to give OpenZeppelin broader access to traditional financial firms.
In practical terms, S&P is using OpenZeppelin’s technical depth to fill a gap in its own onchain toolkit as tokenized assets gain traction.
Tokenized assets are becoming a mainstream buildout
The broader signal behind the acquisition is that putting assets onchain is moving from a crypto-sector experiment to a buildout that traditional financial institutions are now funding and planning around.
In recent years, activity has expanded beyond stablecoins. Money market funds, U.S. Treasuries, fund shares, and even equities have started appearing on blockchain infrastructure. At the same time, market participants are doing more than issuing tokenized versions of assets. They are building out onchain markets around them. That points to a shift that could touch issuance, trading, settlement, and custody rather than simply adding one more token-based asset class.
For established financial firms, the question has already changed. It is less about whether to move onchain and more about whether the infrastructure is secure enough, whether the data is reliable, and how risk should be measured. That helps explain why S&P chose this moment to buy OpenZeppelin. As more traditional financial assets move onto blockchain networks, the market data, benchmarks, and technical risks around those assets will need a new evaluation framework. OpenZeppelin gives S&P a missing piece of that system.