S&P Global to Acquire OpenZeppelin in Onchain Risk Push

S&P Global has reached an agreement to buy OpenZeppelin, a company known for smart contract audits and widely used open-source developer libraries. OpenZeppelin will keep its name and operate as a separate business unit; CEO Demian Brener will remain in place and report to Yann Le Pallec, president of S&P Global Ratings. The companies said financial terms were not released and the transaction must still meet customary closing conditions.

Founded in 2015, OpenZeppelin combines security assessments, secure-development services and public smart-contract libraries. S&P cited the company’s track record of more than 900 security engagements and said OpenZeppelin’s Contracts libraries underpin over $37 trillion in value transferred. OpenZeppelin also reports that its security work has identified more than 10,000 vulnerabilities before code reached production.

The acquisition is intended to broaden S&P’s digital-assets capabilities into the code layer that underpins stablecoins, tokenized funds and DeFi protocols. S&P said the move will allow it to extend its risk assessments into onchain technology and add security assessments and benchmarks to its offerings. S&P Global Ratings has already applied nonfinancial code-related analysis in the digital-asset space: in November 2025 it lowered its stability assessment for Tether’s USDT to 5, or “weak,” from 4, or “constrained.”

OpenZeppelin provides audited services to a range of clients across decentralized finance and traditional infrastructure; its audit page lists names such as Uniswap, Aave, Coinbase, the Ethereum Foundation and DTCC. The company also said publicly that its audits, engineering teams and ecosystem programs will continue unchanged and that its Contracts libraries and other open-source tools will remain free and maintained on GitHub.

Some OpenZeppelin commercial tooling will shift course: the company’s Defender platform had new sign-ups disabled on June 30, 2025, and OpenZeppelin scheduled Defender’s final shutdown for July 1, 2026 while focusing on open-source equivalents. The documentation directs users to migration guides for Defender Monitor and Defender Relayer toward open-source tools such as OpenZeppelin Monitor, which supports onchain activity alerts via Slack, email and webhooks.