They usually come from Chinese IP addresses and leave Chinese comments in scripts, Chinese symbols in binaries, and so on.

In many cases, the systems used in the attack also correlate to actual individuals through other means, such as the attacker logging in to their personal email account and doing daily activities, not being aware that they have been "hacked back" so to speak.

There is probably some percentage of attacks falsely attributed to China, but it's usually obvious, and no one else has much incentive to go to great lengths to impersonate them.

Russians don't care enough to train their operatives to learn Chinese and impersonate them in an attack for example, they'll just hack the US in Russian.

The US just claims every "cyber attack" is the work of Chinese hackers. It is very politically useful both for the continued demonification of what they see as a large adversary but also because it makes the US government appear less incompetent (as they often play up the "elite Chinese hacker" architype).