S&P Global Agrees to Acquire OpenZeppelin

S&P Global has agreed to acquire smart-contract security company OpenZeppelin, bringing the Web3 security provider into the group that includes S&P Global Ratings. Financial terms were not disclosed, the transaction remains subject to closing conditions, and S&P does not expect a material effect on its financial results.

OpenZeppelin would retain its name and operate as an independent business unit after closing. CEO Demian Brener would continue to lead the company and report to Yann Le Pallec, president of S&P Global Ratings. OpenZeppelin said its security audits, engineering work and ecosystem programs would continue with the same team.

Why it matters

The deal gives S&P Global direct access to smart-contract security expertise while adding OpenZeppelin to its research capacity, market data and institutional distribution. OpenZeppelin says more than $37 trillion in value has moved through its Contracts software since 2015, making its code a significant part of the infrastructure supporting blockchain applications.

The announcement also addresses a central concern for developers and customers: OpenZeppelin's public code will remain open source. Future Contracts versions will stay open source, and the company says released versions of its other open-source applications and tools will remain permanently available and cannot be withdrawn. The current Contracts repository uses the MIT License, which permits broad use, copying, modification and distribution.

Market impact

For users, the immediate change is ownership and institutional reach rather than a shift in the core product. OpenZeppelin has promised continuity for audits, engineering work, ecosystem programs and public code, while its existing terms still allow certain changes to paid or hosted plans, including pricing, features, quotas and usage limits.

Until the deal closes, OpenZeppelin remains party to a pending acquisition agreement rather than an S&P business unit. If completed as announced, the transaction would connect institutional risk and data operations with one of the most established names in smart-contract security without removing its open-source foundation.