Or another option - there is something seriously wrong with cryptcoin protocol and/or blockchain (because it adds 10 CRYPT to one address but it doesn't subtract 10 CRYPT from the address from where it was (supposedly) sent).
The exchanges would have picked up on this instantly, so that isn't the answer.
Exchanges don't care or check from which addresses the coins come. They are only interested in that they get coins on the address that they control (they have private key).
I guess that there was human error (or multiple errors). You can't expect that the existing wallet will create "anonymous" transactions if this functionality hasn't been finished yet (and of course it cannot even theoretically be compiled in the executable file of the current wallet).