hi
i checked about 20 spreadsheets of bounty campaigns. and in these lists i found about 15 private keys to ETH addresses.
people post their key instead of their address.
all the addresses had nothing in it. maybe somebody else already emptied them.
Then they really deserve to lose their tokens because its clearly states what is the address and the private key.