A critical bug in a popular push notification library silently exposed millions of crypto wallet users to data theft on Android devices.