As it stands, the public evidence I've seen is
1) The attacks originating from servers owned by Russian companies
2) Pseudo-admission/gloating by low-level officials
3) Wikileaks and Assange's increasingly close relationship with Russia
4) The behavior of the Trump campaign, taking an exceptionally pro-Russian tack. Indeed, the only change they demanded be made to the Republican platform was to take out some anti-Russian commitments.
True, this is all circumstantial. The NSA certainly has more. If the NSA released it, the people who disbelieve the NSA would rightly point out that any really hard evidence could have been planted by the NSA anyway, so it can't be taken as certain that the NSA didn't plant it.
So why should the NSA sacrifice any assets to satisfy them?