Tracking through exchanges address is likely to happen if and only the exchange gives your credentials to the ones who are tracing you, or they themselves wants to track you. Since most legit and big exchange out there requires you to KYC for big amounts of withdrawal, and that will most likely to happen. So either use decentralized exchange or peer to peer.
regarding I.P. addresses, if you are aware if VPN then it will be no problem, creating new bitcoin wallet address and use it once. In our country there are 3rd party apps that lets you exchange your bitcoin with out you submitting KYC protocols, as long as it is in the minimum withdrawals of a thousand dollars.
Is it completely secret? Because if you withdraw and put it in the bank then it's really not a secret anymore. Or maybe it's like Switzerland with banks that are completely unidentified and disobedient to the world's regulations?
That's right, I think some exchanges will still comply with the regulations regarding KYC so if he is asked by the investigators I think he is obliged to notify. If not, then I think the exchange will be in big trouble. So maybe the confidentiality is maintained, but if there are indications of a crime, the investigators will look for it. With KYC it will be traced more easily. So there is cooperation between the two parties.