S&P Global has agreed to acquire OpenZeppelin, bringing a provider of smart contract audits and open-source developer libraries into the financial-data company’s digital asset risk business.
The companies said OpenZeppelin will retain its name and operate as a separate business unit. CEO Demian Brener will continue to lead it and report to Yann Le Pallec, president of S&P Global Ratings. Financial terms were not disclosed, and the transaction remains subject to closing conditions.
The deal moves S&P closer to the code layer beneath stablecoins, tokenized funds and DeFi protocols. S&P said the acquisition would extend its risk-assessment capabilities into onchain technology and support new security assessments and benchmarks.
“Our digital assets strategy centers on bringing trusted data, benchmarks and transparent risk assessment to markets as they move onchain,” Le Pallec said in the announcement.
What S&P Is Buying
Founded in 2015, OpenZeppelin combines security assessments and secure development services with open-source smart contract libraries. The company has conducted more than 900 security engagements, while its Contracts libraries underpin more than $37 trillion in value transferred, according to figures cited by S&P.
OpenZeppelin Contracts gives developers tested implementations of common standards, including ERC token standards, for Ethereum and other EVM-compatible blockchains. Projects can reuse those components instead of writing each function from scratch.
OpenZeppelin also runs a security-audit service that reviews blockchain code. Its audit page lists clients including Uniswap, Aave, Coinbase, the Ethereum Foundation and DTCC, spanning DeFi protocols and traditional financial infrastructure.
OpenZeppelin said its audits, engineering work and ecosystem programs will continue with the same team. It also said released and future versions of its Contracts libraries and other open-source tools will remain open source, free and publicly maintained on GitHub.
The Defender platform requires context. OpenZeppelin’s documentation says it disabled new sign-ups on June 30, 2025 and scheduled Defender’s final shutdown for July 1, 2026 while focusing on open-source versions of tools including Relayer and Monitor. The same documentation directs users to migration guides for moving from Defender Monitor and Defender Relayer.
Defender bundled tools to code, audit, deploy, monitor and operate blockchain applications. The migration path points users to OpenZeppelin Monitor, which watches for specified onchain activity and can trigger notifications through services including Slack, email and webhooks.
Ratings Moves Toward Code Risk
S&P Global Ratings already assesses financial risks in crypto products. In November 2025, for example, it lowered its stability assessment for Tether’s USDT to 5, or “weak,” from 4, or “constrained,” citing an increase in higher-risk assets in the stablecoin’s reserves.
OpenZeppelin provides security assessments and secure development services. The company says its security engagements have surfaced more than 10,000 vulnerabilities before production.
If the acquisition closes, DeFi teams that hire OpenZeppelin will be buying security work from a company owned by S&P Global. OpenZeppelin says the ownership will change without changing the audit team, brand or open-source status of the tools developers use.
Be the first to comment