S&P Global bought the code under $37 trillion of on-chain value
S&P Global agreed to buy OpenZeppelin, the security firm whose open-source library sits under most large stablecoins, for a price it will not disclose and calls immaterial: the option to grade on-chain money is inside SPGI at no disclosed cost. The instruments it would grade are already trading, Pendle's fixed-yield USDG market among them.
Vincent Jiang · 3 min read
The issuer's scorer bought the code's scorer
Credit ratings answer one question: will this entity pay. On-chain money adds a second, whether the contract does what the term sheet says, and on 17 September S&P Global agreed to buy the firm that answers it: OpenZeppelin, whose open-source Contracts library sits under most large stablecoins and tokenized funds 12.
Three company figures travel with the deal, each counting something different: contracts built on the library have moved more than $37 trillion; the firm has run 900-plus security engagements; it has found 10,000-plus vulnerabilities before production 13. Terms were not disclosed and S&P calls the deal immaterial: the on-chain ratings option sits inside SPGI unpriced 2. Demian Brener stays chief executive of a standalone unit reporting to Ratings president Yann Le Pallec; SPGI rose about 1 percent on the day 12.
Two legs in three days
On 14 September, S&P led a round extending data firm Kaiko's Series B to $110 million, with BNP Paribas, Nasdaq Ventures, Coinbase Ventures and Royal Bank of Canada among the investors 45. Kaiko covers more than 150 exchanges and protocols, and S&P Dow Jones Indices chief Cathy Clay called its data "foundational transparency" for institutions moving capital on-chain 4.
Bought three days apart, the two legs cover both risks of tokenized money: what it is worth, and whether the code will deliver it. First-half revenue up 10 percent and $2.25 billion of free cash flow made both cheap 3.
The instruments are outrunning the rating
What S&P would grade is already trading. On 30 September, Pendle opened a fixed-yield market on USDG, the Paxos-issued, Treasury-bill-backed stablecoin in Robinhood's Global Dollar Network, maturing March 2027 on Robinhood Chain; until then Robinhood Earn paid roughly 7 percent variable through Morpho vaults 6. S&P has rated pieces of this world since 2023, including a B- for Sky Protocol and a "weak" stamp on USDT in November 2025 7. What it has never sold is a verdict on the contract itself.
The license, not the logo
The open question is the library, not the letterhead. Existing Contracts versions stay free on GitHub and cannot be pulled, the promise that makes a developer standard buyable 1. Forks that skip the audit stay beyond any acquirer's reach, and audits still get sold one bug at a time: a 2021 Convex Finance review caught a flaw that put about $15 billion of deposits at risk before it was fixed 8. Closing conditions still apply 1.
Boring, public, and a checkbox
Developers will judge the deal by whether the library stays "boring and public," and by whether S&P can sell code risk without turning a public-goods library into a paywall 1. Issuers will judge it by whether "S&P plus OpenZeppelin" becomes a checkbox in a tokenized-fund document 1. The strategy is on the record. The price is not, and the option sits in SPGI either way.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
