i checked about 20 spreadsheets of bounty campaigns. and in these lists i found about 15 private keys to ETH addresses. people post their key instead of their address.
all the addresses had nothing in it. maybe somebody else already emptied them.
When joining bounty we should use separate wallet.Thanks for sharing this observation.