Pull to refresh
Logo
What Changed
Following Why Sign Up
S&P Global acquires OpenZeppelin, the security standard for onchain finance

S&P Global acquires OpenZeppelin, the security standard for onchain finance

Money Moves

S&P is buying the security firm behind most stablecoins and tokenized funds

September 17th, 2026: S&P Global agrees to acquire OpenZeppelin

Overview

Updated Sep 20

S&P Global agreed this week to buy OpenZeppelin, whose code libraries secure most of the world's largest stablecoins and tokenized funds. It's the first time the ratings agency has directly owned blockchain-native infrastructure.

OpenZeppelin's Contracts library has secured $37 trillion in cumulative onchain transfers and powers 8 of the top 10 stablecoins, including USDC. All 10 of the top tokenized money market funds, such as BlackRock's BUIDL, run on its code. Once the deal closes, S&P can assess not just the issuer behind an onchain asset, but the code that runs it.

Why it matters

S&P is set to own the firm that secures most stablecoins and tokenized funds, positioning itself as the gatekeeper for onchain risk.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$37T
Cumulative onchain value secured by OpenZeppelin libraries
Total value transferred through contracts built on the OpenZeppelin Contracts library since the company's founding.
900+
Security engagements conducted
Smart contract audits and security assessments OpenZeppelin has completed for protocols and institutions.
10,000+
Vulnerabilities surfaced before production
Security flaws OpenZeppelin's audit teams have identified before they could be exploited.
8 of 10
Top stablecoins powered by OpenZeppelin
Eight of the ten largest stablecoins by market cap, including USDC, use OpenZeppelin's code.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Demian Brener
Demian Brener
Co-founder and Chief Executive Officer, OpenZeppelin
Staying on as CEO of the OpenZeppelin business unit after the acquisition
 Yann Le Pallec
Yann Le Pallec
President, S&P Global Ratings
Will oversee OpenZeppelin as an S&P Global Ratings business unit

Organizations Involved

S&P Global
S&P Global
Financial data and ratings company
Acquirer

The global ratings and financial data giant, best known for credit ratings that determine borrowing costs for governments and corporations worldwide.
OpenZeppelin
OpenZeppelin
Blockchain security company
Acquisition target; will operate as its own business unit under S&P Global Ratings

The security standard for onchain finance, providing smart contract auditing and the industry-standard open-source Contracts library.

Timeline

2015 September 2026

2 events Latest: September 17th, 2026 · 2 months ago

  1. S&P Global agrees to acquire OpenZeppelin

    Latest Acquisition

    S&P Global announces an agreement to buy OpenZeppelin, the smart contract security and auditing firm, for undisclosed terms. OpenZeppelin joins S&P Global Ratings.

  2. OpenZeppelin founded

    Founding

    Demian Brener and co-founders launch OpenZeppelin to build secure smart contract libraries for blockchain development.

Scenarios

1

Deal closes; OpenZeppelin becomes S&P's onchain security franchise

Likely Resolves by Q2 2027

Discussed by: Decrypt, Forkast, Cryptoslate

The acquisition closes as expected given the modest deal size and S&P's statement that it won't materially affect its financial results. OpenZeppelin's audit business expands into traditional finance as banks and asset managers launching tokenized products use its security assessments as a baseline, mirroring how credit ratings became standard for bonds. Its libraries stay free and open source, preserving developer adoption.

2

Open-source community fractures after acquisition

Possible Resolves by End of 2027

Discussed by: Gate blog analysis

Developers who rely on OpenZeppelin Contracts question whether a corporate parent will prioritize open-source neutrality over commercial interests. The Gate blog explicitly flags integration uncertainty, noting OpenZeppelin's community-driven culture differs significantly from S&P Global's corporate structure. A major fork of the Contracts library emerges, or core maintainers depart, undermining the library's status as the industry default.

3

Regulators impose conditions or block the deal

Unlikely Resolves by Q1 2027

Discussed by: Cryip.co analysis

Given the SEC's active interest in tokenized markets, including its recent innovation exemption for trading tokenized stocks, regulators review the acquisition for competitive or systemic implications. The deal faces an extended review, or conditions are attached limiting how S&P can leverage OpenZeppelin's dominant position in smart contract security.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

June 2018

Microsoft acquires GitHub (2018)

Microsoft paid $7.5 billion for GitHub, the platform hosting most of the world's open-source code. Developers feared Microsoft would steer GitHub toward proprietary interests and compromise its neutrality as the home of open-source development.

Then

GitHub continued operating under its own name with its own leadership, and developer adoption continued growing.

Now

The deal normalized corporate ownership of open-source infrastructure and expanded GitHub's enterprise reach, though some users never fully trusted Microsoft.

Why this matters now

OpenZeppelin faces the same structural question GitHub did: whether an independent open-source community can trust a corporate parent. The GitHub outcome shows the model can work if the acquired entity maintains operational independence.

January 2010

Oracle acquires Sun Microsystems (2010)

Oracle paid $7.4 billion for Sun Microsystems, acquiring Java, MySQL, and Solaris. The open-source community worried Oracle would abuse its control of MySQL, the world's most popular open-source database. Oracle later launched a commercial MySQL offering and fought legal battles over the codebase.

Then

MySQL development slowed amid licensing disputes, and community forks like MariaDB gained ground.

Now

The deal became the standard cautionary tale about what happens to open-source stewardship under a profit-driven corporate owner.

Why this matters now

Oracle/Sun shows the downside scenario for OpenZeppelin's open-source Contracts library if S&P prioritizes commercial interests over community governance.

1909

Moody's publishes first bond ratings (1909)

John Moody published 'Moody's Analyses of Railroad Investments,' the first publicly available bond ratings. The system standardized how investors assessed default risk and made ratings agencies indispensable to capital markets.

Then

Bond ratings became standard practice for US corporate debt within years.

Now

Ratings agencies became the gatekeepers of global capital markets, with S&P and Moody's dominating for over a century.

Why this matters now

S&P's OpenZeppelin acquisition resembles the creation of the ratings industry itself. S&P is attempting to become the trusted authority for assessing risk in a new class of financial products, this time for onchain code rather than corporate bonds.

Sources

(12)
+6
PRNewswire Decrypt Cryptoslate Fintech Global Cryip Forkast Investing News Network CryptoDaily Gate News Dealroom.co Startupik Gate Blog