Pull to refresh
Logo
S&P Global acquires OpenZeppelin, the security standard for onchain finance

S&P Global acquires OpenZeppelin, the security standard for onchain finance

Money Moves

The ratings giant moves from assessing credit risk to owning the code that secures digital assets

Today: S&P Global agrees to acquire OpenZeppelin

Overview

Updated 58 minutes ago

S&P Global agreed this week to buy OpenZeppelin, whose code libraries secure most of the world's largest stablecoins and tokenized funds. It's the first time the ratings agency has directly owned blockchain-native infrastructure.

OpenZeppelin's Contracts library has secured $37 trillion in cumulative onchain transfers. It powers 8 of the top 10 stablecoins, including USDC, and all 10 of the top tokenized money market funds, such as BlackRock's BUIDL. Now S&P can assess not just the issuer behind an onchain asset, but the code that runs it.

Why it matters

S&P now owns the code-security layer under most stablecoins and tokenized funds, positioning itself as the gatekeeper for onchain risk.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$37T
Cumulative onchain value secured by OpenZeppelin libraries
Total value transferred through contracts built on the OpenZeppelin Contracts library since the company's founding.
900+
Security engagements conducted
Smart contract audits and security assessments OpenZeppelin has completed for protocols and institutions.
10,000+
Vulnerabilities surfaced before production
Security flaws OpenZeppelin's audit teams have identified before they could be exploited.
8 of 10
Top stablecoins powered by OpenZeppelin
Eight of the ten largest stablecoins by market cap, including USDC, use OpenZeppelin's code.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

People Involved

Organizations Involved

Timeline

2015 September 2026

2 events Latest: Today
  1. S&P Global agrees to acquire OpenZeppelin

    Today Acquisition

    S&P Global announces an agreement to buy OpenZeppelin, the smart contract security and auditing firm, for undisclosed terms. OpenZeppelin joins S&P Global Ratings.

  2. OpenZeppelin founded

    Founding

    Demian Brener and co-founders launch OpenZeppelin to build secure smart contract libraries for blockchain development.

Scenarios

1

Deal closes; OpenZeppelin becomes S&P's onchain security franchise

Likely Resolves by Q2 2027

Discussed by: Decrypt, Forkast, Cryptoslate

The acquisition closes as expected given the modest deal size and S&P's statement that it won't materially affect its financial results. OpenZeppelin's audit business expands into traditional finance as banks and asset managers launching tokenized products use its security assessments as a baseline, mirroring how credit ratings became standard for bonds. Its libraries stay free and open source, preserving developer adoption.

2

Open-source community fractures after acquisition

Possible Resolves by End of 2027

Discussed by: Gate blog analysis

Developers who rely on OpenZeppelin Contracts question whether a corporate parent will prioritize open-source neutrality over commercial interests. The Gate blog explicitly flags integration uncertainty, noting OpenZeppelin's community-driven culture differs significantly from S&P Global's corporate structure. A major fork of the Contracts library emerges, or core maintainers depart, undermining the library's status as the industry default.

3

Regulators impose conditions or block the deal

Unlikely Resolves by Q1 2027

Discussed by: Cryip.co analysis

Given the SEC's active interest in tokenized markets, including its recent innovation exemption for trading tokenized stocks, regulators review the acquisition for competitive or systemic implications. The deal faces an extended review, or conditions are attached limiting how S&P can leverage OpenZeppelin's dominant position in smart contract security.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

1909

Moody's publishes first bond ratings (1909)

John Moody published 'Moody's Analyses of Railroad Investments,' the first publicly available bond ratings. The system standardized how investors assessed default risk and made ratings agencies indispensable to capital markets.

Then

Bond ratings became standard practice for US corporate debt within years.

Now

Ratings agencies became the gatekeepers of global capital markets, with S&P and Moody's dominating for over a century.

Why this matters now

S&P's OpenZeppelin acquisition resembles the creation of the ratings industry itself. S&P is attempting to become the trusted authority for assessing risk in a new class of financial products, this time for onchain code rather than corporate bonds.

January 2010

Oracle acquires Sun Microsystems (2010)

Oracle paid $7.4 billion for Sun Microsystems, acquiring Java, MySQL, and Solaris. The open-source community worried Oracle would abuse its control of MySQL, the world's most popular open-source database. Oracle later launched a commercial MySQL offering and fought legal battles over the codebase.

Then

MySQL development slowed amid licensing disputes, and community forks like MariaDB gained ground.

Now

The deal became the standard cautionary tale about what happens to open-source stewardship under a profit-driven corporate owner.

Why this matters now

Oracle/Sun shows the downside scenario for OpenZeppelin's open-source Contracts library if S&P prioritizes commercial interests over community governance.

June 2018

Microsoft acquires GitHub (2018)

Microsoft paid $7.5 billion for GitHub, the platform hosting most of the world's open-source code. Developers feared Microsoft would steer GitHub toward proprietary interests and compromise its neutrality as the home of open-source development.

Then

GitHub continued operating under its own name with its own leadership, and developer adoption continued growing.

Now

The deal normalized corporate ownership of open-source infrastructure and expanded GitHub's enterprise reach, though some users never fully trusted Microsoft.

Why this matters now

OpenZeppelin faces the same structural question GitHub did: whether an independent open-source community can trust a corporate parent. The GitHub outcome shows the model can work if the acquired entity maintains operational independence.

Sources

(10)