Transaction Overview
On September 17, 2026, S&P Global (NYSE: SPGI), a provider of ratings, benchmarks, and market data, announced an agreement to acquire OpenZeppelin, a smart contract security firm and developer of widely used open-source software libraries and tools. Financial terms were not disclosed. The announcement comes three days after S&P led a strategic investment in digital asset data provider Kaiko, extending that company’s Series B to $110 million.
Target: OpenZeppelin
Founded in 2015 by Demian Brener and Manuel Araoz, OpenZeppelin provides security audits, engineering services, and developer tools for blockchain applications. The company operates remotely, reports a global team of more than 140 people, and has its registered office in London.
Its core product is OpenZeppelin Contracts, an MIT-licensed library first released in 2016. It provides reusable smart contract components for token issuance, access control, governance, and upgrades. According to the company, the library has supported more than $37 trillion in value transferred and is used by nine of the ten largest stablecoins and all ten of the largest tokenized money market funds by market capitalization. Developers can use the library free of charge, alongside tools including Contracts Wizard, Upgrades Plugins, Relayer, and Monitor.
OpenZeppelin’s paid offerings include smart contract, blockchain infrastructure, and zero-knowledge proof audits, engineering services, and ongoing security support. Its Continuous Security Program, introduced in May 2026, reviews code as it is developed and updated. The company has completed more than 900 security engagements and identified over 10,000 vulnerabilities before production.
Clients and partners include Aave, Uniswap, Fidelity Digital Assets, WisdomTree, DTCC, Coinbase, Fireblocks, and the Ethereum Foundation. OpenZeppelin’s work spans both crypto protocols and institutions developing tokenized financial products. Northzone invested in OpenZeppelin in 2018.
Competitors include Trail of Bits, Halborn, CertiK, Quantstamp, Spearbit (Cantina), Zellic, Sherlock, and Cyfrin.
Buyer: Circle
Headquartered in New York, S&P Global is led by CEO Martina Cheung and traces its roots to 1860. Following the July 1, 2026, spin-off of its Mobility division, the group operates four divisions: 1) Ratings; 2) Market Intelligence, including Capital IQ; 3) S&P Dow Jones Indices; and 4) Energy, including Platts. For the second quarter of 2026, excluding Mobility on a pro forma basis, S&P reported revenue of $3.68 billion (+11% YoY) and net income of $1.21 billion (+22% YoY).
S&P has expanded its digital asset business through ratings, benchmarks, and partnerships. Ratings launched Stablecoin Stability Assessments in December 2023 and now covers 11 stablecoins; these assessments evaluate peg stability and are distinct from credit ratings. In August 2025, it assigned Sky Protocol a B- credit rating, its first for a DeFi protocol. An October 2025 collaboration with Chainlink made S&P’s stablecoin assessments available onchain. S&P Dow Jones Indices and Kaiko tokenized the iBoxx U.S. Treasuries Index in March 2026 and launched the co-branded S&P Kaiko Digital Asset Indices in September.
Other investors in the Kaiko round included BNP Paribas, Nasdaq Ventures, Coinbase Ventures, and DRW Venture Capital. S&P’s individual investment amount was not disclosed. The investment extends an existing data and index partnership; OpenZeppelin would add a separate capability in technical security assessment.
Transaction Parameters
Financial terms were not disclosed. S&P said the acquisition is not expected to have a material impact on its financial results. The transaction remains subject to closing conditions.
OpenZeppelin will operate as its own business unit under its current name, with Brener continuing to lead the business and reporting to Yann Le Pallec, President of S&P Global Ratings. OpenZeppelin said its Contracts library and other open-source tools will remain free and publicly maintained, and that audits, engineering work, and ecosystem programs will continue with the same team. Jefferies and Clifford Chance are advising S&P Global; FT Partners and Cooley are advising OpenZeppelin.
Related acquisitions across digital asset security, data, and infrastructure include: Chainalysis | Hexagate (estimated $60M, M&A Alert), Chainalysis | Alterya (estimated $150M, M&A Alert), Talos | Coin Metrics (reported $100M+, M&A Alert), and DTCC | Securrency (reported $50M, M&A Alert).
Strategic Rationale
S&P sells risk assessments. For assets issued and managed onchain, that requires understanding the underlying technology alongside the issuer and backing assets. A tokenized fund can hold high-quality assets and still expose investors to weaknesses in its smart contracts or access controls. OpenZeppelin adds engineers who can examine those systems, supported by a long record of audits and direct experience developing the software used across the market.
The immediate commercial opportunity is to sell OpenZeppelin’s security services through S&P’s institutional relationships. OpenZeppelin already works with traditional financial institutions, but S&P offers access to a much larger customer base. For a bank or asset manager launching a tokenized product, technical security review sits alongside familiar questions about the issuer and underlying assets.
The Continuous Security Program also creates an opportunity for ongoing client work as applications change. Over time, those reviews could complement S&P’s monitoring of onchain financial products. That would turn a one-off audit into an ongoing client relationship and more recurring revenue.
Architect Partners’ Observations
S&P’s agreement to acquire OpenZeppelin broadens the potential buyer universe for crypto security businesses. Chainalysis’s purchases of Hexagate and Alterya added security and fraud prevention capabilities to a crypto analytics platform. S&P brings a different customer base and a business built around assessing financial risk.
For OpenZeppelin, widespread adoption of free software and growth in paid services are different measures of success. The Contracts library’s reach establishes its importance to the market, but library users do not automatically become customers. S&P’s distribution could help convert that technical reputation into more institutional engagements.
We expect other ratings, financial data, risk and professional services firms to look more closely at independent crypto security providers. The strongest acquisition candidates will combine technical credibility with established institutional clients and ongoing security work. Buyers would gain expertise they can bring to their existing customer relationships, while security firms would gain access to a larger institutional market.
Sources
Press Release, OpenZeppelin, S&P Global Financial Results, Kaiko, Northzone