Hackers are exploiting a vulnerability in React to inject wallet-draining malware into cryptocurrency websites.