This is not acceptable behaviour for any bounty company.
I am sure that the Bountyhunters.io team will see this thread and ignore it, just like they do with the users of their platform:
If you check out their telegram you will see that the admins are not active there, efficiently providing no support to the users.
Suddenly requiring Private key with no warning beforehand is deceiving, especially considering the fact that every other bounty have been distributed automatically.
There has been no announcement about this on neither Telegram or other official social media, participants have not received any email regarding this matter either.
The only reason to require users to give out their private keys will be to save fees, but this does not really make sense either, as the company recently did an ICO where they (claim) to have sold tokens for several million USD. Sending tokens to the participants would at max cost a couple hundred dollars. They could also set op a claim function with Metamask so users wouln't have to expose their private key.