S&P Global agrees to acquire OpenZeppelin, pushing ratings into on-chain security

SPGI said on September 17, 2026 that it has agreed to acquire OpenZeppelin, the blockchain security firm known for more than 900 security engagements and for open-source smart-contract libraries that its own materials say underpin roughly $37 trillion in value transferred. Terms were not disclosed, and the transaction remains subject to closing conditions, so this is a signed agreement rather than a completed deal.

The strategic logic is to put on-chain technical risk inside a ratings framework that currently has no way to express it. A credit opinion on a tokenized instrument today rests on the issuer's balance sheet while saying nothing about whether the contract holding the asset is sound. S&P is buying the capability to assess both in one place.

OpenZeppelin's standing comes from the breadth of its audit portfolio and from libraries that major stablecoin and tokenized-fund issuers build on, which is a different claim from being any single issuer's auditor of record. That distinction is worth holding onto: the reach is in the code that is reused, not in a roster of exclusive audit mandates.

For investors the near-term effect on S&P's numbers is likely immaterial given undisclosed terms and a pending close. What to watch is whether combined rating products actually ship, whether OpenZeppelin's existing audit clients stay once the firm sits inside a ratings agency, and how regulators respond to a major rating agency owning a security auditor whose work it may then rate around.