S&P Global, the company that assigns credit ratings to governments and corporations, has agreed to buy OpenZeppelin. It's a bit like Moody's suddenly acquiring the firm that stress-tests bank vaults — except here the vault is smart-contract code.
Founded in 2015, OpenZeppelin has quietly become the industry's default standard. Its open-source code library is used by thousands of projects to build tokens and protocols, and the company has run more than 900 security audits, catching over 10,000 vulnerabilities before they reached production. By its own count, its tools and standards sit behind $37 trillion in value transferred onchain — a figure that's hard to verify independently but signals just how deeply embedded the firm is in blockchain infrastructure.
Yann Le Pallec, president of S&P Global Ratings, put the rationale plainly: the company's digital assets strategy is about bringing trusted data, benchmarks and transparent risk assessment to markets as they move onchain. OpenZeppelin CEO Demian Brener noted that his company's standards already power the infrastructure behind the world's leading stablecoins — meaning this isn't just about niche DeFi protocols, but money millions of people actually use.
Financial terms weren't disclosed. OpenZeppelin will keep operating as a separate unit under its own name, with Brener staying on as CEO and reporting to Le Pallec. The company says its open-source products will remain free and publicly maintained on GitHub — a detail that matters to developers who've relied on those tools at no cost for years.
The buyer itself is the real signal here. Big traditional institutions aren't just eyeing asset tokenization anymore — they're buying up the infrastructure that makes it safe. If bonds, stocks and funds keep migrating onto blockchains, as recent SEC moves and bank initiatives suggest they will, someone needs to stamp a seal of trust on the code running it all. S&P has apparently decided that role is theirs to take.
