One of the most established names in traditional finance is moving into crypto's plumbing, fast. S&P Global, the ratings and data giant, agreed to acquire OpenZeppelin, the blockchain security firm whose smart-contract code runs beneath most major stablecoins and DeFi protocols. It's S&P's second crypto deal in three days, and together the moves reveal a deliberate strategy: as finance goes on-chain, S&P wants to own the tools that measure and secure it.
The deals
On September 17, S&P Global agreed to acquire OpenZeppelin, the firm behind the open-source smart-contract building blocks that have been an industry standard since 2015. OpenZeppelin says its code has carried more than $37 trillion in value across blockchains, and it has run over 900 security reviews and found more than 10,000 vulnerabilities. Financial terms weren't disclosed. The company will operate as a separate S&P Global business unit, CEO Demian Brener keeps his role reporting to S&P Global Ratings president Yann Le Pallec, and, importantly for developers, its open-source library will remain free and publicly maintained on GitHub.
It follows S&P's other move: three days earlier, it led a strategic investment extending crypto-data provider Kaiko's Series B to $110 million. The Paris-based firm supplies pricing and market data across 150+ exchanges and protocols to more than 250 institutions and regulators. The round drew a striking list of co-investors, BNP Paribas, Nasdaq Ventures, Royal Bank of Canada, Coinbase Ventures, and others, a who's-who of finance backing crypto data infrastructure.
The strategy: data plus security
Read together, the two deals fit neatly. As one analysis put it, Kaiko measures what tokenized assets are worth, while OpenZeppelin checks whether the code holding them holds up. S&P is assembling both halves of the risk equation for on-chain markets: the pricing/valuation layer and the security/code-audit layer. For a company whose entire business is assessing financial risk, that's a logical land grab as banks and asset managers move toward tokenized assets and markets that never close.
There's an uncomfortable fact underpinning the security bet, and it's a strong one. A CoinGecko study of 245 on-chain incidents since January 2025 found that protocols which had already passed independent audits accounted for 88% of all funds stolen, roughly $3.63 billion through July 2026. In other words, "it was audited" hasn't been enough to keep DeFi safe, exactly the gap S&P is betting deeper, institutional-grade security expertise can help address.
This is one of the clearest signals yet that the traditional financial establishment is interestedd in crypto and ready to build and aquire infrustructure.
