S&P Global buys OpenZeppelin, moving from rating token issuers to auditing their code

S&P Global has agreed to acquire OpenZeppelin, the smart-contract security firm whose open-source libraries sit under much of the stablecoin and tokenized-fund market, the companies said Thursday. Financial terms were not disclosed, and the deal is still subject to closing conditions. Both The Block and CoinDesk, reporting off S&P's own press release, describe the same structure: OpenZeppelin keeps its name, operates as a standalone unit, and stays under co-founder and CEO Demian Brener, who will report to S&P Global Ratings President Yann Le Pallec.

The logic S&P offers is that conventional ratings stop at the entity — an issuer's creditworthiness, reserves and balance sheet — and don't touch the software. As CoinDesk put it, a project "can have sound reserves or a strong credit profile but still fail because of a flaw in its smart contracts." OpenZeppelin's work is on that technology layer: onchain security assessments and secure-development services, plus the widely used open-source contract library. S&P is betting that banks and asset managers moving onchain will want a common way to gauge code risk before they scale up, and it now owns a firm that assesses exactly that.

The company and the numbers

OpenZeppelin was founded in 2015. The headline figure attached to it — repeated in both write-ups — is that contracts built with its library have moved more than $37 trillion in cumulative value. CoinDesk was careful to define that: it's "a measure of value transferred through contracts using OpenZeppelin's library over time, not assets the company manages or holds." That distinction matters, because $37 trillion read as assets-under-anything would be wildly misleading; it is a lifetime throughput number for code that a very large share of the market happens to use.

On the audit side, S&P said the firm has conducted more than 900 security engagements. CoinDesk added a figure The Block did not carry: those engagements surfaced over 10,000 vulnerabilities before code reached production, again attributed to S&P. Every one of these figures originates with the buyer or the target — there is no independent measure here.

The two accounts don't conflict on any number; they corroborate the $37 trillion and 900-engagement claims, with CoinDesk supplying the extra vulnerability count and the crucial clarification on what the trillions actually represent.

Where it fits in S&P's crypto build-out

This is not a one-off. CoinDesk lays out a sequence for the roughly $120 billion company. It has spent more than a year building digital-asset coverage: publishing stablecoin stability assessments and issuing what it calls the first credit rating of a DeFi protocol, Sky. On Monday it led a strategic investment that extended crypto data firm Kaiko's Series B to $110 million, alongside BNP Paribas, Nasdaq Ventures, Coinbase Ventures and Royal Bank of Canada. Earlier in September, S&P Dow Jones Indices and Kaiko launched a co-branded digital-asset index suite; in March the two tokenized the iBoxx U.S. Treasuries Index. OpenZeppelin, in S&P's telling, extends that arc "from rating the entity to rating the code it runs on."

Key facts

• Deal: S&P Global (SPGI) agreed to acquire OpenZeppelin, announced Thursday, 2026-09-17 (S&P press release, via The Block and CoinDesk).
• Terms: Not disclosed; subject to closing conditions; "not expected to have a material impact" on S&P's financial results (S&P).
• Structure: OpenZeppelin keeps its name, runs as a standalone unit under CEO Demian Brener, who reports to S&P Global Ratings President Yann Le Pallec (both sources).
• Scale claims (all from the parties): $37 trillion in cumulative value transferred through contracts using its library; 900+ security engagements; 10,000+ vulnerabilities caught pre-production (S&P, per CoinDesk).
• Firm: OpenZeppelin founded 2015; onchain security assessments, secure-development services, open-source contract library.
• Context: S&P is ~$120B; led Kaiko's $110M Series B extension on Monday; launched a Kaiko-branded index suite in September; tokenized the iBoxx U.S. Treasuries Index in March; earlier issued a DeFi credit rating on Sky (CoinDesk).

The real-world read

The cleanest thing to say about this deal is what neither party emphasizes: a ratings agency is buying the auditor of the code it intends to rate. Credit-ratings firms already carry a structural conflict — the issuer-pays model, where the entity being rated foots the bill. Folding a code auditor into a rater layers a second version of that problem onto onchain finance: the same corporate parent may soon both rate a tokenized product's issuer and vet its smart contracts. Keeping OpenZeppelin as a "standalone unit" that "retains its name" is the standard move for preserving an auditor's perceived independence — but ownership is ownership, and the reporting line runs straight into S&P Global Ratings. That tension is the story the press release is built to smooth over, and it's worth watching how S&P walls off (or doesn't) the audit function from the ratings business.

On the numbers, treat the marketing sheen with the usual skepticism. The $37 trillion is the kind of figure that sounds like custody or AUM and is neither — CoinDesk's clarification that it's lifetime throughput through any contract using the library is the useful correction, and Cleartext readers should carry that caveat wherever they see the number quoted. The 900 engagements and 10,000 vulnerabilities are self-reported by the buyer and target with no external audit of the audit; they may well be accurate, but they are interested-party claims, not independently verified facts.

What's conspicuously unsaid: the price. "Not expected to have a material impact" on a $120 billion company's financials tells you the check was small relative to S&P — a tuck-in, not a bet-the-company move — but the actual number, and what OpenZeppelin's investors and employees got, isn't disclosed. Also unsaid is how the acquisition affects OpenZeppelin's existing audit clients, some of whom compete with, or will be rated by, S&P.

Opinion, and whose

• OpenZeppelin CEO Demian Brener framed the deal as extending the firm's reach: its standards already "power the infrastructure behind the world's leading stablecoins, tokenized funds, DeFi protocols, and onchain markets," and S&P lets "that foundation" reach more institutions. That is the seller's characterization of his own product.
• S&P Global Ratings President Yann Le Pallec said the digital-assets strategy "centers on bringing trusted data, benchmarks, and transparent risk assessment to markets as they move onchain," and that OpenZeppelin would give both traditional institutions and DeFi-native firms "the confidence to build and transact." That's the buyer's thesis, not an established outcome.
• The forecast underlying the whole deal — that banks and asset managers will need a common standard for smart-contract risk before adopting onchain products at scale — is CoinDesk's paraphrase of S&P's bet. It's a plausible read of where institutional tokenization is heading; it is a bet, not a fact.

Sources

• The Block (Tier 2, secondary), "S&P Global agrees to acquire OpenZeppelin in onchain security push," 2026-09-17 — deal structure, reporting line, Brener and Le Pallec quotes, $37T and 900-engagement claims. Explicitly sourced to S&P's press release (i.e., company marketing).
• CoinDesk (Tier 2, secondary), "Ratings giant S&P Global acquires OpenZeppelin in tokenized finance risk push," 2026-09-17 — corroborated the same figures and structure, and added the 10,000-vulnerability claim, the clarification that $37T is value transferred (not AUM), S&P's ~$120B scale, and the Kaiko/Sky/iBoxx context. Also drawn largely from S&P's announcement.
• Underlying primary source: S&P Global's press release announcing the acquisition — the origin of every scale claim and executive quote above, and marketing by definition.

This is news coverage, not financial advice; nothing here is a recommendation to buy or sell anything.