Militant Islamist group Islamic State claimed responsibility for Friday's rampage but there were indications that Russia was pursuing a Ukrainian link, despite emphatic denials from Ukrainian officials that Kyiv had anything to do with it.
Russia's state Investigative Committee said 133 people had been killed. State TV editor Margarita Simonyan, without citing a source, had earlier given a toll of 143.
In a televised address, Putin said 11 people had been detained, including the four gunmen. "They tried to hide and moved towards Ukraine, where, according to preliminary data, a window was prepared for them on the Ukrainian side to cross the state border," he said.
The FSB security service said the gunmen had contacts in Ukraine and were captured near the border. It said they were being transferred to Moscow.
Neither Putin nor the FSB publicly presented any proof of a link with Ukraine, with which Russia has been waging war for the past 25 months.
Ukrainian military intelligence spokesman Andriy Yusov told Reuters: "Ukraine was of course not involved in this terror attack. Ukraine is defending its sovereignty from Russian invaders, liberating its own territory and is fighting with the occupiers’ army and military targets, not civilians."
Islamic State has a strong motivation to strike Russia, which intervened against it in Syria's civil war in 2015, and security analysts said the IS claim seemed plausible as it fit the pattern of past attacks.
Putin cast the enemy as "international terrorism" and said that he was ready to work with any state that wanted to defeat it.
"All the perpetrators, organisers and those who ordered this crime will be justly and inevitably punished. Whoever they are, whoever is guiding them," Putin said. "We will identify and punish everyone who stands behind the terrorists, who prepared this atrocity, this strike against Russia, against our people."
A senior Russian lawmaker, Andrei Kartapolov, said that if Ukraine was involved, then Russia must deliver a "worthy, clear and concrete" reply on the battlefield.
Western nations, including the United States whose ties with Moscow have been fraught since its invasion of Ukraine, condemned the attack and expressed sympathy for the Russian people affected. Arab powers and many former Soviet republics also expressed shock and sent their condolences
"We condemn terrorism in all its forms and stand in solidarity with the people of Russia in grieving the loss of life from this horrific event," U.S. Secretary of State Antony Blinken said in a statement.
Verified footage showed camouflage-clad gunmen opening fire with automatic weapons in the Crocus City Hall near Moscow. Video showed people taking their seats, then rushing for the exits as repeated gunfire echoed above screams.
Investigators said some died from gunshot wounds and others in a huge fire that broke out in the complex. Reports said the gunmen had lit the blaze using petrol from canisters they carried in rucksacks.
People fled in panic. Baza, a news outlet with good contacts in Russian security and law enforcement, said 28 bodies were found in a toilet and 14 on a staircase. "Many mothers were found embracing their children," it said.
Russian lawmaker Alexander Khinshtein said the attackers had fled in a Renault vehicle that was spotted by police in Bryansk region, about 340 km (210 miles) southwest of Moscow on Friday night. He said a car chase ensued after they disobeyed orders to stop.
Khinshtein said a pistol, a magazine for an assault rifle, and passports from Tajikistan were found in the car. Tajikistan is a mainly Muslim Central Asian state that used to be part of the Soviet Union.
TV editor Simonyan published a video showing one of the suspects, a young, bearded man, being interrogated aggressively by a roadside, replying in heavily accented Russian to a series of barked questions. He said he had flown from Turkey on March 4 and had received instructions from unknown people via Telegram to carry out the attack in exchange for money.
The man was trembling throughout the questioning. He was initially shown lying on his stomach with his hands bound behind his back, his chin resting on the boot of a figure in camouflage uniform. Later he was hauled up onto his knees.
Another man with cuts and bruises to his face was shown being questioned via an interpreter while sitting on a bench with bound hands and feet.
The Kremlin said Putin had held conversations with the leaders of Belarus, Uzbekistan and Kazakhstan in which all sides affirmed their willingness to work together to fight terrorism.
Long lines formed in Moscow on Saturday for people to donate blood. Health officials said more than 120 people were wounded.
Russia tightened security at airports, transport hubs and across the capital and big public events were cancelled across the country.
Islamic State, which once sought control over swathes of Iraq and Syria, claimed responsibility for the attack, the group's Amaq agency said on Telegram.
Islamic State said its fighters attacked on the outskirts of Moscow, "killing and wounding hundreds and causing great destruction to the place before they withdrew to their bases safely". The statement gave no further detail.
On Saturday it released a photograph of what it said were the four attackers.
A U.S. official said United States had intelligence confirming Islamic State's claim of responsibility for the shooting. The official, speaking on condition of anonymity said Washington had warned Moscow "appropriately" in recent weeks of the possibility of an attack.
Friday's attack, about 20 km (12 miles) from the Kremlin, happened two weeks after the U.S. embassy in Russia warned that "extremists" had imminent plans for an attack in Moscow.
Hours before the embassy warning, the FSB said it had foiled an attack on a Moscow synagogue by Islamic State's affiliate in Afghanistan, known as ISIS-Khorasan or ISIS-K, which seeks a caliphate across Afghanistan, Pakistan, Turkmenistan, Tajikistan, Uzbekistan and Iran.
Putin changed the course of the Syrian civil war by intervening in 2015, supporting President Bashar al-Assad against the opposition and Islamic State.
"ISIS-K has been fixated on Russia for the past two years, frequently criticizing Putin in its propaganda," said Colin Clarke of the Soufan Center, a New York-based research group.
The broader Islamic State group has claimed deadly attacks across the Middle East, Afghanistan, Pakistan, Iran, Europe, the Philippines, and Sri Lanka.
