S&P, the world's rating agency, has acquired a crypto security company

Original | Odaily (@OdailyChina)

Author｜Azuma (@azuma_eth)

S&P, which provides ratings, indices, and data services to global financial markets, is now extending its reach onchain.

On September 17, S&P Global announced that it has reached an acquisition agreement with blockchain security firm OpenZeppelin. The transaction amount was not disclosed, and the deal remains subject to closing conditions. After the acquisition is completed, OpenZeppelin will continue to operate as an independent business unit, retaining its original brand, and CEO Demian Brener will continue to lead the business, reporting to Yann Le Pallec, President of S&P Global Ratings.

For OpenZeppelin's clients, there will be little change in the short term. The company made it clear that OpenZeppelin Contracts and other open-source applications and tools will remain free and open-source, and will continue to be publicly maintained on GitHub; security audits, engineering services, and ecosystem projects will also continue to be handled by the original team.

But for S&P, this deal is clearly not just about buying a "crypto security company."

A Security Company Behind $37 Trillion in Assets

If OpenZeppelin is understood merely as a smart contract auditing firm, its value may be underestimated.

OpenZeppelin's business can actually be divided into two parts: one is commercial security services for institutions and large protocols, and the other is open-source infrastructure for the entire blockchain developer ecosystem.

Since its founding in 2015, OpenZeppelin has completed more than 900 security engagements and discovered over 10,000 vulnerabilities, including more than 700 high-risk and critical vulnerabilities. Its clients have long since expanded beyond native crypto projects. Circle, Coinbase, Uniswap, Aave, as well as institutions and projects such as BlackRock, Franklin Templeton, and WisdomTree, have all used OpenZeppelin's technology or security services.

But beyond the auditing business, OpenZeppelin's greater value lies in the fact that it has already consolidated its security capabilities into a set of open-source infrastructure widely used across the entire industry. Today, OpenZeppelin's core product, OpenZeppelin Contracts, has become critical infrastructure for onchain development. Developers can directly call standardized code that has undergone extensive testing and verification to build smart contract functions such as tokens, access management, governance, and upgrades.

More importantly, this open-source code has become deeply embedded in a large number of real financial applications. The latest data shows that OpenZeppelin Contracts has more than 850,000 weekly NPM downloads, over 27,000 GitHub Stars, and more than 300,000 dependent repositories. OpenZeppelin states that its smart contract libraries have cumulatively facilitated more than $37 trillion in value transfers.

So rather than calling OpenZeppelin a "crypto auditing company," it is more accurate to say it is becoming a security infrastructure provider for onchain finance — and this "security foundation" may be exactly what S&P is really after.

Why Did S&P Make Its Move?

Judging from S&P's own statements, the answer behind acquiring OpenZeppelin is actually very straightforward: traditional finance is moving onchain, and S&P wants to master risk assessment capabilities within this new financial infrastructure.

S&P's business is not limited to the well-known "S&P Ratings." Its operations cover credit ratings, indices, market data, research, and analysis, among other areas. In essence, it provides standardized tools for measuring risk, pricing, and comparing assets in financial markets.

Over the past few years, S&P has clearly accelerated its digital asset strategy. Just days before the OpenZeppelin acquisition, S&P Global had just announced that it led a new funding round for crypto market data company Kaiko. The two parties had previously partnered to launch the S&P Kaiko Digital Asset Indices and, in March of this year, brought the iBoxx U.S. Treasury Index onto the blockchain in the form of native digital assets.

Putting these two developments together, S&P's planned roadmap becomes fairly clear — investing in Kaiko is about effectively mastering onchain data, while acquiring OpenZeppelin is about gaining risk identification capabilities for onchain financial infrastructure.

As the integration of traditional finance and onchain finance deepens, what traditional institutions lack today is not merely a technical solution to tokenize assets. Institutions also need to know how the assets themselves should be priced, whether market data is reliable, whether smart contracts have vulnerabilities, and what technical risks the underlying infrastructure carries.

This is also the most noteworthy aspect of this acquisition. S&P Global stated that OpenZeppelin will help it extend its risk assessment capabilities to the "onchain technology-risk layer" and further apply them to onchain financial products; meanwhile, S&P's institutional clients, market data, research capabilities, and global distribution channels can help OpenZeppelin reach more traditional financial institutions.

To put it more plainly, S&P needs OpenZeppelin's technical capabilities to fill its own shortcomings in the onchain world and prepare for the potential broader trend of assets moving onchain.

Assets Moving Onchain Is Now a Question the Traditional World Must Answer

Behind S&P's acquisition of OpenZeppelin, the greatest symbolic significance lies in this — assets moving onchain has gradually evolved from an experiment in the crypto industry into a new trend in which traditional financial institutions are genuinely committing resources to build.

Over the past few years, beyond stablecoins, traditional assets such as money market funds, U.S. Treasuries, fund shares, and even equities have begun to be brought onto the blockchain. What players across the relevant segments are doing is also shifting from simply "issuing onchain assets" toward more diverse efforts to "build onchain markets." This means that the future changes in financial markets may not simply be the emergence of another asset class carried by tokens, but rather the increasing use of onchain infrastructure across more and more segments, from issuance and trading to settlement and custody.

For traditional institutions, the question has long since shifted from "whether to move onchain" to "whether the onchain infrastructure is secure enough, whether the data is reliable, and how risk should be measured." This also explains why S&P chose to acquire OpenZeppelin at this point in time — as more and more traditional financial assets begin to enter the onchain world, the market data, benchmarks, and technical risks surrounding these assets naturally require a new evaluation system, and OpenZeppelin is precisely the missing piece for S&P.