Similarly, I don't doubt that the NSA has the ability to attribute an attack to an attacker. What I doubt is that the NSA has the ability to tell the truth in public.
You are correct that it seems the NSA is unable to tell the truth to the public. The NSA never stated publicly that WannaCry is from North Korea.
>The NSA declined to comment.
The NSA having the information leaked is more beneficial than saying it directly. If at any point something shows it clearly wasn't North Korea, the NSA can claim they have made not official statements and the leak was using bad information. But if such information doesn't come out, then we get what we currently have, which is the public having been informed that North Korea is responsible. What more could the NSA have asked for? Well maybe North Korea directly claiming responsibility, but besides for that.