Just over $2.7 billion. That’s how much hackers drained from crypto wallets and protocols in 2025, according to data reported by TechCrunch. Every dollar of that came out of someone’s pocket: a saver, a small business owner, a parent sending money home. On September 17, 2026, one of the most trusted names in finance decided to do something about it. S&P Global agreed to acquire OpenZeppelin, and that deal puts real institutional weight behind OpenZeppelin blockchain security work that already helps protect an estimated $37 trillion in on-chain value.
What OpenZeppelin’s Blockchain Security Work Actually Covers
OpenZeppelin isn’t a household name, but its code probably touches money you’ve used without you knowing it. The company builds open-source libraries that developers plug straight into smart contracts. It has also run more than 900 security audits for DeFi platforms, stablecoin issuers, and banks testing tokenized assets. Under the deal, OpenZeppelin keeps its name and its CEO, Demian Brener, stays in charge. S&P Global is folding the team into its ratings and risk business, not replacing it.
S&P Global Ratings president Yann Le Pallec said the acquisition is meant to bring “trusted information, benchmarks and transparent risk assessments” to digital asset markets as more financial activity moves onchain.
Think about what an S&P bond rating already does, even if you’ve never bought a bond yourself. It gives banks, pension funds, and everyday investors a fast, trusted signal for risk. This deal aims to build something similar for smart contracts. That matters, because blockchain security has mostly meant scattered audit firms, inconsistent standards, and a lot of trust-me marketing.
How This Could Protect Your Money
Picture a nurse working overnight shifts in Ohio who parks part of her paycheck in a stablecoin savings app, because it pays better than her credit union’s 0.4% rate. A $5,000 balance earning 4.5% instead of 0.4% works out to roughly $200 more a year. That’s real grocery-and-gas money. She has never read a line of code, and she shouldn’t have to. What she needs is confidence that the app she trusts didn’t skip its homework.
That’s exactly the gap S&P Global says it wants to close. If ratings-style benchmarks for smart contract risk become the norm, picking a safer app could someday be as simple as checking a grade, the same way you’d check a credit score before signing a lease.
Not a Fix Yet, But a Signal
None of this eliminates risk overnight. The deal still has to close, and the financial terms weren’t disclosed. But it lands in good company. It’s the same instinct behind smaller, quieter fixes making news lately, like the security patch protecting Bitcoin’s Lightning Network. It also follows just days after Ondo wired tokenized fund settlement into DTCC’s network. Wall Street’s plumbing is quietly rewiring itself around blockchain rails, and the firms doing the rewiring want proof it won’t leak.
Other outlets are reading the deal the same way. FXStreet framed it as part of a broader push into on-chain security assessment, not a one-off publicity move.
What to Watch Next
Two things will tell you whether this actually changes anything. Watch whether S&P Global publishes public, specific ratings for individual stablecoins and DeFi protocols, not just internal audits nobody outside the industry ever sees. Watch, too, whether competitors follow. One ratings agency backing smart contract security is a headline. Three or four competing on it is an industry standard, and that’s when your bank, your remittance app, or your retirement account starts to feel it.