Crypto security firm ZenGo has identified a double-spend exploit dubbed "BigSpender" that allows an attacker to cancel transactions without the receiving user knowing.