S&P Global Acquires OpenZeppelin, Bringing Wall Street Closer to Onchain Security

Wall Street Eyes Onchain Security Gaps

S&P Global has signed an agreement to acquire OpenZeppelin, a blockchain security firm best known for its open-source smart contract libraries and security assessments.

OpenZeppelin’s reach extends across both Web3 startups and established financial institutions, having completed over 900 security engagements and identified more than 10,000 vulnerabilities prior to projects launching. Its software has facilitated over $37 trillion in value transferred since its founding in 2015—a figure that underscores the scale at which smart contract security now operates. S&P Global does not expect this acquisition to have a material impact on its financial results, yet the strategic importance appears significant.

The move comes just days after S&P Global led a strategic investment round for Kaiko, extending the crypto data provider’s Series B funding to $110 million. That back-to-back activity signals a clear intent: S&P is positioning itself as a key player in digital asset infrastructure as onchain markets mature.

OpenZeppelin to Stay Open Source

Despite joining a major Wall Street institution, OpenZeppelin will continue operating under its own name as a separate business unit within S&P Global. CEO Demian Brener will remain at the helm and report directly to Yann Le Pallec, President of S&P Global Ratings. The entire OpenZeppelin team—including those responsible for audits, engineering, and ecosystem programs—will stay in place once the deal closes.

Crucially, OpenZeppelin’s widely used contracts library and other open-source tools will remain free and publicly maintained on GitHub under the MIT License.

This decision preserves access for thousands of developers who rely on these libraries to write secure code for Ethereum and other blockchains. The contrast is striking: while Wall Street often leans toward proprietary technology, S&P has opted to keep one of crypto’s most foundational toolkits open and accessible—a move that may help bridge trust between traditional finance and decentralized communities.

$37 Trillion Secured—And Counting

Since its inception in 2015, OpenZeppelin’s smart contract software has processed more than $37 trillion in value transferred across various blockchains. This headline number is impressive; however, it's important to note that while such volume demonstrates widespread adoption and trust in their codebase, it also magnifies the stakes for any potential vulnerabilities.

In addition to its software footprint, OpenZeppelin has conducted more than 900 formal security engagements with clients ranging from DeFi protocols to global banks. The company claims it has found over 10,000 vulnerabilities before production—a track record that highlights both the persistent risks facing digital assets and the growing demand for professional audits as capital flows into onchain products.

S&P Global plans to leverage OpenZeppelin’s expertise not only for technical audits but also for developing new benchmarks and risk data services tailored to tokenized assets and blockchain-based financial products. As reported by cointelegraph.com, these services are expected to help institutional investors better understand—and potentially mitigate—the unique risks associated with programmable money.

Financial Watchdog Deepens Crypto Ties

The acquisition follows recent moves by U.S. regulators such as the SEC introducing an “innovation exemption,” which allows certain platforms to trade tokenized U.S. stocks on public blockchains without registering as national securities exchanges. This regulatory shift opens doors for new types of digital asset trading venues—yet it also pushes technical risk management into sharper focus.

S&P Dow Jones Indices previously helped develop the S&P Digital Markets 50 Index, which combines equities from 35 blockchain-related companies with 15 cryptocurrencies and leverages Chainlink for onchain verifiability. Bringing OpenZeppelin into its orbit gives S&P direct oversight of security practices underpinning this next generation of financial products—a micro-contrast emerges here: Wall Street is seeking transparency through decentralization while simultaneously asserting control over how that transparency is secured.

For now, until closing conditions are met, OpenZeppelin remains an independent entity under a pending acquisition agreement. It’s unclear how quickly new joint offerings will emerge or whether rival firms will follow suit—but with $37 trillion already secured by OpenZeppelin’s codebase and S&P’s growing involvement in digital markets, scrutiny over blockchain security standards is set to intensify.

What remains uncertain

It remains unclear when the S&P Global acquisition of OpenZeppelin, announced on September 17 and still subject to closing conditions, will be finalized; if the transaction fails to close, OpenZeppelin will not become an S&P business unit and its current independent status will persist immediately.