Inside the Organized Crime Ring That Stole Nearly $1 Million Worth of Bikes From Denver Retailers

Like most 3 a.m. phone calls, the one that woke Lisa Kaveggia on September 8, 2019, delivered unwelcome news: Mojo Wheels, the Denver bike shop she’d owned for 31 years, had just been burglarized.

Kaveggia roused herself and, still in her pajamas, rushed to the store. When she arrived, she found a gaping hole where Mojo’s front entrance used to be. The door lay inside the showroom—knocked off its hinges and out of its frame—and a section of wall was visibly pushed in. “The whole front of my building was exposed,” Kaveggia says. Thieves, police told her, had used a stolen Denver Public Schools van to smash in the door and grab six high-end mountain bikes valued at about $30,000 total.

The robbery that night at Mojo was the first in what would become an unprecedented crime spree targeting Colorado bike shops. From September 2019 to June 2020, a ring of at least eight people allegedly perpetrated roughly 30 break-ins up and down the Front Range, carting off more than 200 bikes—a haul valued at nearly a million dollars, according to a series of grand jury indictments presented by the Colorado Attorney General’s Office this past October.

Dubbed “Operation Vicious Cycle” by the AG’s office, the investigation reveals the new reality of bike theft in America. Lured by expensive merchandise, professional criminals work in groups and combine simple techniques, like smash-and-grabs, with more lucrative and harder-to-investigate ways to sell stolen goods, often transporting them across state and even federal borders. Attorney General Phil Weiser declined to comment specifically about Vicious Cycle because it’s still an open case. But, speaking in general terms, he says, “We’re seeing organized, systematic bike theft, and other forms of retail theft, happening at a scale that I believe is a recent phenomenon.”

Just weeks after the first break-in, thieves again attacked Mojo with another vehicle, this time at the rear entrance. Although they failed to access the building, a month later an engineer sent by Kaveggia’s insurance company delivered the worst news yet. The second violent collision had damaged a structural I-beam in the building, which Kaveggia owns. “He said, ‘Your building is totaled, and you need to get the hell out of here before it falls in on you,’” Kaveggia says. One thought ran through her mind: These people killed my company.

Bike theft has historically been a crime of opportunity. From garages, off car and bike racks, or from patio railings at coffeeshops, bikes are pilfered from their owners one or two at a time by criminals who do a quick risk-reward analysis in their heads. Retailers, on the other hand, have long dealt with tactics such as credit card fraud, shoplifting, and test-ride theft. But large-scale smash-and-grabs, while a threat, weren’t common.

Lately, that’s changed. “I don’t have hard statistics,” says Scott Chapin, a Minnesota-based insurance broker for Marsh & McLennan Agency who has specialized in the bike industry for almost two decades. “But, in the past two years, the frequency [of break-in claims] I’m seeing has at least doubled.” Denver Police Department (DPD) crime data doesn’t separate retail bike thefts from personal property, but the total number of bikes stolen in the city rose from 2,736 in 2017 to 4,219 in 2020, before falling to 3,759 last year.

The people who began hitting Colorado bike shops in fall 2019 were after one thing: mountain bikes. Expensive ones. That partly explains why the primary targets were independent bike shops. In 1991, when Kaveggia opened Mojo, bikes were mostly made of steel and aluminum, using technology that hadn’t changed much in decades. “I think about $1,200 was the most you could spend, and that was insane,” she says. (That’s roughly $2,500 today, accounting for inflation.)

In the past decade, bicycle technology has advanced dramatically, with carbon fiber frames and wheels, sophisticated suspension designs, hydraulic disc brakes, and even electronic shifting driving up prices. High-end, full-suspension mountain bikes today start around $5,000 and climb into the low five figures. (Road and e-bikes are similarly pricey and are often stolen as well, but for some reason, they didn’t entice the Vicious Cycle thieves.) According to the DPD, the estimated average value of stolen bikes increased 26 percent from 2017 to 2021, to $1,824.

As bike values have risen, they’ve attracted a different kind of criminal. “This is organized crime,” says Andrew Love, head of brand security and investigations for California-based Specialized, one of the world’s biggest bike brands. Vicious Cycle thieves allegedly hit the company’s Boulder Experience Center, a demo and service shop, in December 2019 and walked off with $73,000 worth of bikes. “You have people who know what they’re doing, and they do it over and over,” Love says.

It’s also become easier to unload ill-gotten goods. Whereas a decade ago, criminals had to turn to local resellers such as pawnshops and secondhand sports stores—or a few platforms such as eBay and Craigslist—today, online “recommerce” has atomized and anonymized the sale of goods, particularly on social media. “People can open up an anonymous account on, to take one example, Facebook Marketplace,” Weiser says. “They say, ‘Just send me the money, and I’ll send you the bike.’  ” Facebook is not the only place stolen bikes are sold online, but it’s a prominent target of criticism. Hawking pinched products is against Facebook’s policies, but Specialized’s Love and other sources say the social media giant is slow to ban sellers. “Facebook is hell to deal with these days,” Love says. (Facebook would not comment on the record for this story but encourages users to report suspicious listings and contact local authorities to report stolen goods for sale. The company’s enforcement is largely automated, but it does rely on human teams to manually review listings in some cases.)

On top of all that, the demand for bikes skyrocketed during the COVID-19 pandemic. People discovered that two-wheeled rides provided a socially distanced alternative to mass transit and a healthy, virus-safe way to spend time outdoors. At the same time, factories closed and shipping logistics snarled, stalling the global supply chain and stymieing retailers’ abilities to stock inventory. With bikes scarcer than ever, less conventional sellers became a more attractive option.

Because Weiser’s office would not go into specifics about Operation Vicious Cycle, most of the details of the ring’s alleged activities come from court documents—which paint a vivid, if incomplete, picture.

According to his 83-count indictment, a man named Maurice Leday played a central role, organizing and coordinating the burglaries, including recruiting other participants, often via Facebook Messenger. Leday, a 22-year-old Denver resident, has a lengthy adult criminal record in Colorado, including convictions for motor vehicle theft, reckless driving, and eluding authorities. Adrian Rocha-Chairez, 56, whom the indictments describe as a fence—someone responsible for receiving and selling stolen goods—appears to have been a key player, but he died while the case was still pending. (Before his Vicious Cycle indictment, Rocha-Chairez’s criminal record in Colorado consisted solely of a few traffic violations).

The indictments claim Rocha-Chairez would sometimes dictate to Leday how many bikes he needed from a theft or thefts. Then, one or more members of the larger criminal enterprise—Leday allegedly worked with a number of accomplices—would steal a passenger van or box truck and use it to ram through a store entrance. Other times, they would simply throw a rock through a display window. They’d work quickly, rarely dallying for longer than a couple of minutes. After a successful theft, the indictments claim, Leday would deliver the bikes to Rocha-Chairez, who coordinated with another alleged fence, 48-year-old Salvador Mena-Barreno, to move the bikes out of state.

The thieves were as bold as they were efficient. Adam Rachubinski owns Alpha Bicycles, which at the time had a location in the Denver Tech Center and one in Littleton. In June 2020, Vicious Cycle members allegedly robbed his DTC outpost. That same night, as Rachubinski was sweeping up the broken glass, his security company called to say the alarm was going off. “So I gave them the password, and they said, ‘That’s not it,’  ” Rachubinski says. “And I thought, Oh, crap, I have separate passwords for the two separate stores.” Sure enough, thieves were at his Littleton shop, nabbing seven more bikes. Giant Cycling World in Littleton, the most victimized shop, was hit five times.

The Vicious Cycle robbers may have been daring and organized, but they weren’t exactly criminal masterminds. Only three months after the spree began, a suspect admitted to investigators that he’d perpetrated one of the jobs, although the indictments don’t reveal why he confessed. The next month, Leday’s indictment alleges, police recovered a beer bottle from a stolen truck, and DNA analysis produced matches for Leday’s mother and her boyfriend (neither was indicted). The biggest break came on April 25, 2020, when Leday and others allegedly broke into the Bikery at the Brewery in Littleton and made off with 13 bikes worth a total of nearly $50,000. A responding officer pursued the group, who fled with such haste that eight of the bikes fell out of the back of the stolen U-Haul. Police claim they found the abandoned truck less than an hour later—with Leday’s cell phone on the ground outside and his fingerprint on the driver’s side door. Law enforcement then used phone records and cell towers to track an alleged co-conspirator’s location as he executed subsequent thefts—including at Alpha.

Court documents don’t reveal when that evidence was presented to a grand jury; or why 18 months elapsed between the last thefts listed in the indictments and the arrests; or whether Alpha really was the group’s final score. They also don’t offer much insight into whether the alleged thieves were part of a larger crime ring that authorities are still investigating. What the allegations in the indictments do reveal is where the stolen bikes likely went.

From his home in Portland, Oregon, Bryan Hance—spurred by his own experiences losing bikes to thieves and a desire to expand his coding skills—has been building online communities to battle bike theft for nearly two decades. He co-founded his most successful venture, Bike Index, in 2013. The privately run, nonprofit database allows anyone to register their bike’s serial number and post about stolen or recovered ones. In January 2021, an anonymous tipster messaged Hance about the rise in thefts in Colorado. “That was the beginning,” he says, “of a very long, very deep rabbit hole.”

Hance had always wondered how thieves fenced bikes, especially high-end ones, without attracting notice. Working independently and unaware of law enforcement’s interest in the case (he did eventually provide investigators with some information), Hance spent months using Bike Index’s database, conversations with victims, and open-source intelligence to track stolen bikes. The trail Hance discovered led from Colorado to an obscure shop 640 miles away in Ciudad Juárez, Mexico, just south of El Paso, Texas, called Alexander’s Bikes. Alexander’s appeared to operate solely through a Facebook page, geo-locked so it was only visible to IP addresses inside Mexico. On that Facebook page, Hance found listing after listing, often for new bikes: pricey Yetis and Santa Cruzes, and even a few from Denver’s Guerrilla Gravity. Of the first 43 listings Hance investigated, he matched 10 to bike-theft victims in Colorado.

None of the bikes Hance catalogued have been traced directly to the Vicious Cycle robberies. But Hance, who didn’t start his investigation until seven months after the last burglary recorded in the indictments, believes there’s an inordinate amount of evidence tying the thieves to Alexander’s. The AG’s office says that fence Mena-Barreno’s box truck “made multiple crossings at the United States/Mexico border between August 2019 and August 2020,” which roughly matches the timelines of the shop thefts listed in the indictments. Investigators also claim Mena-Barreno’s bank records showed a pattern of “large cash deposits made in El Paso, Texas,” and “cash withdrawals made in the Denver metro area coinciding with this burglary series.” Mena-Barreno told law enforcement in December 2020 that he buys items in Denver, including bikes, to sell at a flea market in El Paso and denied that his truck crossed the border.

For Hance, the evidence seemed to confirm something he’d long suspected: Bike theft is a transnational trade. “This has always been one of those urban legends,” he says. “Everyone always thought, Well, maybe they go into Mexico, but had zero proof.”

One thing is for sure, though. Although Alexander’s didn’t seem to lack for bikes to sell, the same couldn’t be said of the victimized shops in Colorado. The bike boom and supply chain issues brought on by the pandemic meant stolen models that would normally have been easy to replace through the manufacturer were, in some cases, impossible to find. Even with his insurance payout, Rachubinski says, “we couldn’t make up for those lost sales.”

The thieves hurt more than just Colorado’s cycling community. Allegedly, the crime ring twice stole vans from Denver Public Schools and on three occasions lifted vans from nonprofit Mile High Youth Corps (MHYC). Then CEO Brigid McRaith says that outside of sporadic vandalism, MHYC had not been the target of criminal activity in her 15 years with the organization. While all three vans were recovered, two were totaled, and insurance payouts covered less than half of the replacement costs.

In December 2021, Hance went public with Bike Index’s findings in a blog post, which attracted attention from a variety of publications and on social media—putting Alexander’s under intense scrutiny. The proprietor denied selling stolen bikes at first and threatened legal action over the Bike Index post. (Hance says he has not been sued.) But a few days after that initial statement, Alexander’s posted a new one claiming that, after collaborating with authorities, the business had identified eight stolen bikes among those in its possession. The owner denied being involved in the thefts and claimed to be a victim of organized crime himself.

Shortly thereafter, Alexander’s owner deleted the Facebook page. A month later, however, Alexander’s relaunched on Facebook, stating that the shop had been “mistakenly” linked to a theft ring and announcing an unspecified strategy “to prevent future inconveniences.”

“He’s online right now, selling bikes as we speak,” Hance told 5280 in March, expressing frustration that numerous complaints to Facebook before he went public with his investigation—and even the investigation itself—had failed to get the page taken down. “I was like, ‘What the fuck does it take for you guys to deplatform somebody?’  ” Facebook declined to respond on the record regarding Alexander’s, but in April 2022, the company removed the page for violating its policies on selling stolen items. In a sign of how difficult it is to thwart online crime, however, a private Facebook group called Alexander’s Bikes, with 22,000 members, remained active. Hance says some of the bike listings were the same as from the old page. After 5280 notified Facebook of Alexander’s private group, that page was also taken down.

In March 2022, Governor Jared Polis signed House Bill 1099, which will require anyone who sells more than $5,000 in goods in a year in Colorado on an online platform, like Facebook Marketplace, to provide the outlet with identifying information such as bank account and tax ID numbers. The law doesn’t take effect until 2023 and would be hard to enforce against sellers outside of Colorado. Nevertheless, Weiser believes the legislation will eventually help thwart bike thieves by inhibiting their abilities to offload their plunder. Specialized’s Love, however, is skeptical of its impact and points to the federal Shop Safe Act, which has similar provisions and is pending in Congress, as a better option. “If you’re Amazon,” he says, “it’s not practical to have one version of the law for Colorado and another for Wyoming.”

But even the Shop Safe Act wouldn’t be able to police Alexander’s—or other foreign sellers. Although the shop owners we spoke with said police took their investigations seriously, international theft rings create jurisdictional obstacles for local law enforcement. “The minute you say ‘Mexico,’ you can just hear the tone shift on their end, like, ‘Oh, well, that’s long gone,’ ” Hance says. Operation Vicious Cycle was a multiagency investigation, and Weiser thanked the FBI Safe Streets Task Force in a release announcing the arrests. But for the most part, Love says, “you have to have crimes in the millions [of dollars] before federal guys will touch it.” The FBI does investigate organized retail theft, focusing on “the most egregious major theft activity that crosses state and sometimes international lines.” But the agency declined to comment when 5280 asked about whether there are thresholds—monetary or otherwise—that trigger its involvement. “If you were going to commit crimes and want to remain safe, and you’re one-quarter bright,” Love says, “[transnational] is what you do.”

As such, the bike industry is sometimes left to fight the problem itself. Love says he shares tips on criminal activity, techniques to stop it, and resources such as government contacts with colleagues at other brands. Hance was encouraged by the public response to his report, including criticism of Alexander’s by the Ciudad Juárez shop’s Mexican customers. “Part of our hope,” Hance says, “is that even if we can’t repossess all these bikes, maybe we can trash the market for them.” Buyers can help by only shopping at established secondhand merchants—Sprocket.bike and the Pro’s Closet, based in Louisville, require ID for all sellers—and checking serial numbers against databases managed by private organizations such as Bike Index and Seattle-based 529 Garage.

But those measures didn’t scare the Vicious Cycle ring—or its copycats. In March, thieves broke into Driven Technologies in Boulder and stole three bikes, including two that featured the startup’s prototype drivetrain system and were valued at around $70,000 total. “I strongly feel we were targeted as a bike company,” Driven CEO Jason Smith told the website Cycling Tips. “The thieves only took the high-end bikes. They didn’t touch the laptops, expensive tools, or lab equipment.” Police quickly arrested a suspect after he took one of the bikes to a local shop; all the stolen goods were recovered, and Driven was able to get back to business quickly.

Kaveggia wasn’t so lucky. She initially assumed the damage to her building could be repaired in a few weeks. Instead, she ended up moving Mojo to a temporary home for 10 months. The repair contractor had to cut a hole in the roof and use a crane to install the replacement I-beam. She says the insurance claim for the stolen bikes, building repair, temporary move, and other items amounted to almost half a million dollars. All during a once-in-a-century pandemic and while dealing with historic customer demand and crippling supply chain disruption.

Kaveggia opened Mojo three decades ago to serve Denver’s growing mountain bike community. The brand is a fixture at local downhill and enduro races, where it sponsors a developmental team with riders ranging from eight to 62 years old and offers mechanical support to other racers. So, even as the thought flashed through her head that this band of criminals had killed her business over $30,000 worth of bikes, she never seriously considered giving up. That would have felt like failure.

Instead, after absorbing the engineer’s awful news about the I-beam, Kaveggia sat in shock before crying for about an hour. “And then,” she says, “I went back to doing business.”