Three days before it agreed to buy OpenZeppelin, S&P Global led a $110 million funding round into crypto market-data firm Kaiko. Together the two deals look less like opportunistic bolt-ons than like a ratings group assembling every input needed to assess a tokenised instrument end to end: the market data that prices it, and the code that issues and moves it. The agreement to acquire OpenZeppelin, announced on September 17, 2026, moves S&P Global Ratings from judging the creditworthiness of an entity to judging the smart contract that entity deploys.
What the deal covers
Financial terms were not disclosed, and S&P Global said the transaction is not expected to have a material impact on its financial results — a useful tell that this is a capability purchase, not a revenue purchase. It remains subject to closing conditions. OpenZeppelin will continue to operate under its own name as a separate business unit, with co-founder Demian Brener staying on as chief executive and reporting to Yann Le Pallec, President of S&P Global Ratings.
Founded in 2015, OpenZeppelin is known for three things: the open-source Contracts library, which the companies say underpins more than $37 trillion in cumulative value transferred, including most of the largest stablecoins and tokenised funds; an audit practice that has run more than 900 engagements and surfaced more than 10,000 vulnerabilities before production; and Defender, its operational security and incident-response platform.
Nothing changes, says OpenZeppelin
OpenZeppelin moved quickly to reassure the developer base that supplies its distribution. In its own announcement, it said the Contracts libraries remain open source, free and publicly maintained on GitHub, that every released version stays permanently open source and cannot be withdrawn, and that audits and ecosystem programmes continue with the same team. That matters commercially as much as reputationally: the library’s ubiquity is why the audit practice has pricing power, and a licence change would have handed the position to Trail of Bits, Certora or Spearbit within a release cycle.
“OpenZeppelin’s standards, technology, and expertise already power the infrastructure behind the world’s leading stablecoins, tokenized funds, DeFi protocols, and onchain markets,” Brener said. “With S&P Global, that foundation reaches a broader set of organizations entering this market, as well as the blockchain networks and DeFi protocols gaining institutional adoption.”
Le Pallec framed the purchase as an extension of an existing programme rather than a new one. “As digital assets and tokenized markets continue to mature, OpenZeppelin’s technology and expertise will complement our smart contract and onchain technology risk assessment capabilities, giving traditional financial institutions and DeFi-native companies alike the confidence to build and transact in this new environment,” he said.
Why a ratings agency wants an auditor
S&P Global Ratings has been building a digital-asset franchise for two years and keeps hitting the same wall: its methodologies assess balance sheets, governance and counterparties, none of which capture the risk that a contract behaves in a way nobody intended. Its Stablecoin Stability Assessments run on a one-to-five scale from very strong to weak, and in August it reported six of the 11 stablecoins covered scored adequate or better. In August 2025 it gave Sky, formerly MakerDAO, a B- issuer credit rating, the first for a DeFi protocol, citing depositor concentration and centralised governance. It has since rated tokenised treasury vehicles including the Franklin OnChain U.S. Government Money Fund and OpenEden’s TBILL fund, and a 2025 collaboration with Chainlink put the stability assessments onchain for protocols to read directly.
For issuers, the consequence is straightforward and not entirely comfortable. Anyone bringing a tokenised fund or a regulated stablecoin to market already needed a credible audit to satisfy counterparties; the direction of travel is that the audit becomes a rated input rather than a marketing artefact. It is the same consolidation of assurance and assessment that made structured finance uncomfortable in the last cycle, and it invites the obvious question of what firewall sits between the unit reviewing the code and the unit grading the issuer that deploys it. S&P has not published criteria describing that separation.
Watch three things over the next two quarters: whether S&P opens a criteria consultation admitting code-security findings into its digital-asset methodologies; whether OpenZeppelin’s audit pricing moves once it sits inside a Nationally Recognized Statistical Rating Organization; and whether Moody’s or Fitch answer by buying a rival auditor. Our coverage of Basel’s crypto capital rules, securities tokenisation in South Korea, onchain price feeds for tokenised equities and the Open USD stablecoin consortium points the same way: the institutions setting the rules for tokenised markets are buying the plumbing rather than waiting for it to standardise.
This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.
Karthik Subramanian
Karthik Subramanian is a founder, writer, and technology consultant with nine years in the crypto ecosystem. He covers token economics, L1/L2 infrastructure, DeFi protocols, wallets/custody, and the bridge between crypto and forex—broker technology, liquidity, and macro drivers. Karthik’s writing focuses on clear, practical frameworks that help professionals evaluate new products and on-chain innovation alongside FX market realities.
