A critical security vulnerability has been discovered in Android Bitcoin wallet apps that could leave users "vulnerable to theft".