S&P Global agrees to acquire OpenZeppelin, the security firm behind most stablecoin smart contracts

S&P Global has entered into an agreement to acquire OpenZeppelin, a company whose open-source smart-contract library and security audits underpin much of the infrastructure behind stablecoins and tokenized funds, the companies announced. Financial terms of the deal were not disclosed, and S&P Global said the transaction is not expected to have a material impact on its financial results.

OpenZeppelin, founded in 2015, maintains the OpenZeppelin Contracts library, a widely used open-source codebase that the company says underpins more than $37 trillion in value transferred onchain, including the majority of the largest stablecoins and tokenized funds. The company has also conducted more than 900 security engagements auditing smart contracts for vulnerabilities before they go into production — a service comparable to a code audit firm, but focused specifically on the self-executing contracts that move money on blockchains.

For S&P Global, best known for credit ratings and financial benchmarks, the acquisition extends its ratings and risk-assessment business into what the company calls the onchain technology-risk layer: assessing not just whether a borrower or bond is creditworthy, but whether the smart-contract code underlying a tokenized asset is secure. S&P Global framed the deal as part of a broader strategy of bringing its existing risk-assessment brand and institutional relationships to digital-asset markets as more capital-markets activity moves onchain.

The companies said OpenZeppelin will continue to operate as its own business unit under its existing name and leadership, reporting into S&P Global Ratings, rather than being absorbed directly into S&P Global’s existing structure. The transaction remains subject to closing conditions, and no completion date was disclosed.