Where did the exchange get them from and then where did they get them from and then where did they get them from and then where did they get them from?. ......etc. There has to be an end.
You lost with the hash comment.
The exchanges get them from people who create accounts and deposit coins to later be traded or sold. Like all exchanges, they take a cut of all trades.
Think of hashes as encrypted stings that get "cracked/processed" to find bitcoins. A Pentium 7 processor should be capable of doing about 50 mega hashes a second. At the current difficulty, it would take it 46 years running 24/7 to find one bitcoin.