S&P Global on September 17 agreed to acquire OpenZeppelin, the smart contract security firm whose open-source library underpins $37 trillion in cumulative value transferred across EVM blockchains. Financial terms were not disclosed. S&P stated the deal would not materially affect its financial re...
"Our digital assets strategy centers on bringing trusted data, benchmarks and transparent risk assessment to markets as they move onchain." — Yann Le Pallec, President, S&P Global Ratings
S&P Global on September 17 agreed to acquire OpenZeppelin, the smart contract security firm whose open-source library underpins $37 trillion in cumulative value transferred across EVM blockchains. Financial terms were not disclosed. S&P stated the deal would not materially affect its financial results. The acquisition places the code-auditing infrastructure used by 9 of the top 10 stablecoins and all 10 of the top 10 tokenized money market funds under the same corporate umbrella that rates their issuers.
The deal is the fourth major digital asset move by S&P in 14 months, following its first-ever DeFi protocol credit rating (Sky Protocol, B-, August 2025), on-chain stablecoin stability assessments via Chainlink (October 2025), and the Vault Risk Assessment framework for DeFi lending vaults (October 2026). Three days before announcing the OpenZeppelin acquisition, S&P led a strategic investment pushing crypto data provider Kaiko's Series B to $110 million. The combined effect: S&P Global is constructing a vertically integrated risk-assessment stack — from entity creditworthiness to stablecoin peg stability to vault impairment risk to smart contract code integrity — that has no equivalent in traditional or digital finance.
The timing coincides with the DTCC's planned October 2026 commercial launch of its tokenization service covering Russell 1000 constituents, major index ETFs, and U.S. Treasury securities — assets collectively representing a significant portion of the $114 trillion held in DTC custody. As institutional capital enters on-chain markets at scale, the infrastructure to assess whether that capital is secure becomes systemically important.
S&P Global (NYSE: SPGI), with a market capitalization of approximately $137 billion and trailing twelve-month revenue of $16.1 billion, announced the agreement to acquire OpenZeppelin on September 17, 2026. OpenZeppelin will retain its name and operate as a separate business unit. CEO and co-founder Demian Brener will continue to lead the unit, reporting to Le Pallec.
Jefferies LLC served as financial adviser and Clifford Chance as legal counsel to S&P Global. FT Partners provided financial and strategic advice to OpenZeppelin, with Cooley as legal counsel.
The open-source OpenZeppelin Contracts library — licensed under MIT — will remain free and publicly available. The audit practice, which has completed more than 900 security engagements and identified over 10,000 vulnerabilities before production deployment, becomes part of S&P Global Ratings' digital asset infrastructure.
"With S&P Global, that foundation reaches a broader set of organizations entering this market, as well as the blockchain networks and DeFi protocols gaining institutional adoption," Brener said in the press release.
OpenZeppelin's footprint in the EVM ecosystem is difficult to overstate:
| Metric | Value | |--------|-------| | Cumulative value transferred | $37–38.1 trillion | | Total value locked in OZ-derived contracts | $152 billion | | Transactions processed | 6.9 billion | | Active wallets interacted | 429.7 million | | Token deployments using OZ Contracts | 150,000+ | | GitHub stars | 27,300 | | GitHub forks | 12,400 | | Weekly npm downloads | 789,434 | | npm packages depending on OZ Contracts | 3,717 | | Market share across top EVM assets | 88% | | Top 10 stablecoins using OZ Contracts | 9 of 10 | | Top 10 tokenized money market funds using OZ | 10 of 10 | | Security engagements completed | 900+ | | Vulnerabilities found before production | 10,000+ | | Client retention rate | 95%+ | | TVL secured across clients | $110 billion+ |
Founded in 2015, OpenZeppelin grew from an open-source Solidity library into a full security services provider. The firm previously operated Defender, a monitoring and operations platform used by over 15,000 developers, though it phased out the hosted product by July 1, 2026, redirecting focus to open-source tooling.
The Contracts library provides standardized implementations of ERC-20, ERC-721, access control, and other foundational smart contract patterns. Its ubiquity means that a vulnerability in an OpenZeppelin module could propagate across thousands of deployed contracts simultaneously — a risk profile that motivated both the acquisition and its critics.
S&P Global Ratings has constructed its digital asset practice through four distinct products deployed in sequence over 14 months:
Move 1: Protocol Credit Rating (August 2025). S&P assigned Sky Protocol (formerly MakerDAO) a B- issuer credit rating with stable outlook — the first formal credit rating of any DeFi protocol. The rating covered stablecoin liabilities (USDS, DAI) and flagged a 0.4% capital ratio, depositor concentration, and governance centralization. Moody's followed with its own B3 rating of Sky in October 2026.
Move 2: Stablecoin Stability Assessments On-Chain (October 2025). S&P partnered with Chainlink to deliver its Stablecoin Stability Assessments via DataLink oracle infrastructure on Base. The SSA rates peg-maintenance ability on a 1-to-5 scale across 11 stablecoins. As of August 2026, six of 11 rated stablecoins scored "adequate" (level 3) or above. USDC scored 2 ("strong"); Tether's USDT was downgraded to 5 ("weak") in November 2025.
Move 3: Vault Risk Assessment (October 4, 2026). S&P launched letter-grade assessments for DeFi lending vaults, targeting a market that grew from $1.5 billion to $10 billion in deposits in 24 months. The VRA evaluates six dimensions — portfolio credit quality, liquidity mismatch, curator risk, blockchain risk, protocol risk, and vault security/governance — using a scale from AAA(v) to CCC(v). The "(v)" suffix distinguishes these from traditional credit ratings.
Move 4: Smart Contract Code Integrity (September 17, 2026). The OpenZeppelin acquisition adds code-level security assessment to S&P's stack. Where the protocol rating evaluates the entity, the SSA evaluates the stablecoin's peg, and the VRA evaluates the vault's impairment risk, OpenZeppelin's audit practice evaluates the underlying code. The deal closes a gap that previously required institutional allocators to source technical due diligence from separate, unrated providers.
Three days before announcing the OpenZeppelin deal, S&P led the strategic round pushing Kaiko's Series B to $110 million, with co-investors including DRW, Susquehanna, Royal Bank of Canada, Nasdaq, and BNP Paribas. Kaiko provides institutional-grade crypto market data — pricing, order book depth, and trade feeds — that feeds into the benchmarks and indices S&P already operates.
The through-line: data (Kaiko), benchmarks (S&P indices), entity ratings (Sky), instrument ratings (SSA), deployment ratings (VRA), and code security (OpenZeppelin). S&P is assembling the complete risk infrastructure for markets that trade 24/7 without closure windows, settlement delays, or centralized gatekeepers.
S&P is not building alone. Moody's and Fitch are each pursuing parallel, if differently structured, strategies:
Moody's Ratings launched its Token Integration Engine (TIE) on March 17, 2026 — a network-agnostic layer that pushes Moody's credit ratings directly onto blockchain networks. The initial deployment ran on the Canton Network. In June 2026, Moody's expanded TIE to Solana mainnet through a partnership with AlphaLedger, making Solana the first major permissionless blockchain to carry live Moody's ratings in machine-readable form. Moody's also published a dedicated stablecoin rating methodology and assigned the first-ever issuer rating to Sky Protocol (B3, stable outlook) on October 7, 2026.
Fitch Ratings maintains institutional risk coverage across crypto exposures and has published DeFi lending analysis, though its blockchain-native data delivery infrastructure is less developed than those of S&P or Moody's.
The competitive dynamic mirrors what happened in structured finance during the 2000s: rating agencies racing to establish methodology first in a new asset class, with first-mover advantage translating into standard-setting power. The difference is that on-chain markets introduce technical risk layers — smart contract vulnerabilities, oracle manipulation, MEV extraction, bridge exploits — that have no analog in traditional fixed income.
S&P's OpenZeppelin acquisition gives it a structural advantage in this specific dimension. Neither Moody's nor Fitch has acquired or announced plans to acquire a smart contract security firm. Moody's on-chain presence focuses on distributing existing ratings data; S&P's approach integrates the production of new, code-specific risk assessments.
The acquisition introduces a structural tension that multiple analysts have flagged. OpenZeppelin Contracts holds an estimated 88% market share across top EVM assets. S&P Global now controls the firm that wrote the code and operates the practice that audits it.
This creates three distinct concentration risks:
Monoculture risk. A critical vulnerability in OpenZeppelin Contracts could affect thousands of deployed tokens, vaults, and protocols simultaneously. The 2016 Parity multisig wallet bug — which froze $280 million in ETH — demonstrated how a single library flaw can cascade. With 88% market share, the blast radius of an OpenZeppelin-level bug would be substantially larger.
Audit independence. S&P's traditional ratings business has faced decades of scrutiny over the issuer-pays model, in which the entity being rated also pays for the rating. The OpenZeppelin deal creates an analogous concern: the firm that wrote the most widely used smart contract library is now owned by the firm that rates protocols and vaults built on that library. Whether internal firewalls between the audit practice and the ratings division can prevent conflicts of interest remains an open question.
Open-source governance. The Contracts library is licensed under MIT and will remain freely available. However, the library's AGPL-3.0-licensed operational tools (Relayer, Monitor) carry different terms. S&P has stated it will maintain the open-source nature of the Contracts library, but the long-term incentive structure of a $137 billion public company owning an open-source standard differs from that of an independent security firm.
The broader smart contract audit market, valued at approximately $3.1–3.4 billion in 2026 according to Grand View Research and The Business Research Company, is projected to grow to $16.3 billion by 2034. The market's top four firms — OpenZeppelin, CertiK, Trail of Bits, and Consensys Diligence — collectively held approximately 31.2% market share as of 2025.
Current audit pricing, according to a February 2026 Sherlock benchmark:
Each remaining major firm occupies a distinct niche. Trail of Bits leads in cryptographic and zero-knowledge circuit audits, maintaining Slither, Echidna, and Medusa as open-source tooling. Certora specializes in formal verification, using its Prover engine to mathematically verify contracts against written specifications. Consensys Diligence brings deep Ethereum-native expertise with a track record across Aave, Balancer, and 1inch.
The S&P/OpenZeppelin deal may accelerate two dynamics. First, remaining independent audit firms become more valuable as differentiated alternatives — Trail of Bits' ZK specialization and Certora's formal verification cannot be replicated by S&P overnight. Second, institutional clients may increasingly demand "rated" audits from the S&P-integrated practice, potentially creating a two-tier market where S&P-stamped reviews carry pricing power that independent firms cannot match.
The DTCC's tokenization service, scheduled for full commercial launch in October 2026, provides the institutional demand signal that contextualizes S&P's strategy. The service will tokenize assets held in DTC custody — currently valued at over $114 trillion — starting with Russell 1000 constituents, major index ETFs, and U.S. Treasury securities.
Over 50 firms participate in the DTCC Industry Working Group, including BlackRock, JPMorgan, Goldman Sachs, Citi, Bank of America, Morgan Stanley, Schwab, State Street, Nasdaq, NYSE, Circle, Ondo, Ripple Prime, Fireblocks, BitGo, Tradeweb, and Virtu. The SEC issued a no-action letter in December 2025 authorizing DTC to operate the service for three years on pre-approved blockchains.
When trillions of dollars in traditional securities exist as on-chain tokens, the infrastructure questions shift from theoretical to operational. Who rates the smart contract that issues the token? Who assesses the vault where the token is lent? Who evaluates the protocol's creditworthiness? S&P is positioning to answer all four questions — entity, instrument, deployment, and code — from a single integrated platform.
From an economic value distribution perspective, S&P's vertical integration strategy adds a new extraction layer to on-chain finance. Rating agency fees in traditional markets consume 2–10 basis points of issuance volume. If similar fee structures apply to vault risk assessments, stablecoin stability scores, and code audits, the cumulative cost of S&P's full-stack risk assessment could represent a meaningful percentage of the organic revenue generated by DeFi protocols.
The blockchain sector generates approximately $13.7 billion in identifiable on-chain income against $86–113 billion in total funding flows, according to the foundational economic value analysis. An additional risk-assessment cost layer, paid by protocols, vault curators, or stablecoin issuers, ultimately reduces the share of economic value flowing to depositors and liquidity providers. Whether the institutional capital unlocked by rated infrastructure more than offsets this extraction — through lower cost of capital, expanded collateral eligibility, and regulatory legitimacy — will determine whether S&P's presence is net accretive or extractive to on-chain ecosystems.
The precedent from traditional markets is mixed. Credit ratings expanded access to capital markets for previously unrated issuers, lowering borrowing costs. They also created a gatekeeping oligopoly that extracted rents from every debt issuance for decades. On-chain markets are replicating this path in compressed time.
S&P Global's acquisition of OpenZeppelin is not a single transaction. It is the capstone of a deliberate, sequenced strategy to become the default risk-assessment provider for institutional on-chain finance. Entity ratings, stablecoin assessments, vault grades, code audits, and market data — each acquired or built in sequence over 14 months — now sit under one $137 billion corporate umbrella.
The closest analog in traditional markets is the post-2000 consolidation of credit ratings, index provision, and market data under S&P, Moody's, and MSCI. That consolidation produced durable oligopolies. Whether on-chain markets — built on open-source infrastructure and permissionless protocols — can resist the same centralizing gravitational pull remains the open structural question. S&P is betting they cannot. The data so far suggests it may be correct.