S&P Global Closes Acquisition of Onchain Security Firm OpenZeppelin

S&P Global (SPGI ) announced on October 26, 2026 that it has completed its acquisition of OpenZeppelin, the onchain security firm it first agreed to acquire on September 17, 2026. Financial terms of the transaction were not disclosed, and S&P Global said the deal is not expected to have a material impact on its financial results.

S&P Global described OpenZeppelin as the security standard for onchain finance and said the acquisition complements its risk assessment capabilities in digital asset markets. According to the company, the transaction brings OpenZeppelin’s deep expertise in onchain ecosystem development into the organization and enhances its ability to create the next generation of onchain security assessments and benchmarks, and to deliver essential intelligence as capital markets transition onchain. S&P Global said the acquisition expands its risk assessment capabilities into the onchain technology-risk layer that underpins onchain financial products, while its trusted brand, deep institutional relationships and global distribution accelerate OpenZeppelin’s reach into traditional finance.

Founded in 2015, OpenZeppelin combines onchain security assessments and secure development services with OpenZeppelin Contracts, an open-source smart contract library. According to S&P Global, the firm’s security team has conducted more than 900 engagements for the protocols and institutions defining digital asset markets, surfacing more than 10,000 vulnerabilities before production, while OpenZeppelin Contracts underpin over $38 trillion in value transferred, including many of the largest stablecoins and tokenized funds. Alongside its security and open-source work, OpenZeppelin’s engineering team builds secure onchain infrastructure for blockchain networks and institutions.

Structure, Terms and Advisors

OpenZeppelin will continue to operate as its own business unit under the OpenZeppelin name. Founder Demian Brener will continue to lead the business, reporting to Yann Le Pallec, President of S&P Global Ratings.

“Completing this acquisition is an important step for our digital assets strategy,” Le Pallec said. “As more of the financial system moves onchain, market participants need a clear view of the technology risk that sits beneath the assets they hold.” He added that OpenZeppelin’s expertise, from blockchain and smart contract security assessments and secure development to its widely used open-source library, is already foundational to that infrastructure, and that together the firms can help traditional financial institutions and DeFi-native companies understand and manage those risks.

Brener said OpenZeppelin begins its next chapter as part of S&P Global. “Our team will keep doing what it does best: security assessments and secure development for the world’s leading protocols, networks and institutions building onchain finance, while OpenZeppelin Contracts remain open source, free and publicly maintained,” he said, adding that with S&P Global the firm can expand the reach and impact of those standards across global markets.

Jefferies LLC served as financial advisor to S&P Global, and Clifford Chance acted as its legal advisor. FT Partners served as exclusive financial and strategic advisor to OpenZeppelin, and Cooley acted as OpenZeppelin’s legal advisor.

S&P Global first announced the transaction on September 17, 2026, when it said it had entered into an agreement to acquire OpenZeppelin subject to closing conditions. That announcement set out the same post-closing structure, with OpenZeppelin operating as its own business unit under its own name and Brener reporting to Le Pallec. The September release stated that OpenZeppelin Contracts underpinned over $37 trillion in value transferred, including the vast majority of the largest stablecoins and tokenized funds; the completion announcement states the figure at over $38 trillion.

In notes to editors accompanying the completion announcement, S&P Global defined smart contracts as software code stored on a blockchain that automatically executes predefined rules when specified conditions are met. In a tokenized money market fund, for example, a smart contract may issue new fund tokens when an investor subscribes, verify compliance requirements and automatically process redemptions. The notes state that while smart contracts can improve efficiency and reduce the need for intermediaries, they may be vulnerable to coding errors, bugs or malicious attacks that can result in financial losses. According to the notes, firms often manage those risks by using pre-audited and community-reviewed smart contract libraries such as OpenZeppelin Contracts, engaging smart contract auditors to review code for vulnerabilities, and monitoring contracts once they are live. The notes add that open-source code can further strengthen resilience by allowing a broader community to identify and address risks on an ongoing basis.