One not-so-bad solution could be similar to what StackOverflow does: The issuer of the bounty may decide who gets it. But even if they don't issue it to anyone, they don't receive their sum back. There there currency is points, but if it's real money, any unreleased bounties could go to some kind of general community pot for that project or whole Github after a while.
