As I understand it, the evidence is a chatlog and an encrypted container. The police have had a hard time proving that he was one of the people in the chat. The encrypted container, which the police somehow broke (wonder how they did that), had data from the Danish hack and private documents which doesn't look too good. Also he avoided a sentence for hacking into Nordea in Sweden by claiming that his computer was remote controlled and they couldn't prove that it was not.

I'd say it looks fairly likely that he had something to do with these crimes. Also I wouldn't say they have no evidence just that they probably don't have enough to convict. The arguments for continuing to hold him are pretty thin. He already had unsupervised meetings with family and friends so holding him because they are afraid of evidence tampering seems questionable.

Everyone knows he did it.