$37 trillion in tokenized assets have moved through infrastructure secured by OpenZeppelin, per S&P Global (NYSE: SPGI), which is acquiring the smart-contract security firm in a deal that extends its ratings reach from the instrument tier to the code that runs it. Financial terms were not disclosed.
OpenZeppelin, founded in 2015, provides onchain security assessments, secure development services, and an open-source smart contract library in use across many of the largest stablecoins and tokenized funds. The firm claims to have identified more than 10,000 vulnerabilities before code reached production. Its library sits inside infrastructure shared by competing products across the market.
What the deal closes
S&P Global's ratings business has covered the instrument tier. A tokenized bond or money-market fund can be assessed; the code running it cannot. A project can carry strong reserves and a solid credit profile yet still fail because of a flaw in its smart contracts. Conventional ratings, as S&P has acknowledged, do not currently reach the code that issues, moves, and manages stablecoins.
The OpenZeppelin acquisition closes that coverage gap. S&P Global's stated bet is that banks and asset managers will need ways to assess smart-contract risk before they use onchain products at scale. In its news release, the company described the deal as one that "complements S&P Global's risk assessment and ecosystem development capabilities in digital asset markets."
Management has said separately that the company is preparing for wider adoption of tokenized financial products, digital representations of stocks and other assets running on blockchain rails. The purchase extends that preparation from rating an onchain instrument to rating the code it runs on.
SPGI shares have fallen 21% over the past 12 months and last traded at $404.69.