[bradford]

Everything you said is true, but I'd like to elaborate a bit further: sometimes state involvement can be inferred when the exploit involves computing resources which could only be reasonably wielded by a nation-state.

For example, suppose that this exploit involved the reversal of an MD5 hash (and this is simply an example, I'm not saying that the actual exploit did). How much computing power would be required to do this? I couldn't do this reliably on my home machine, nor could I afford the cloud-compute power to perform it. However, assembling a vast array of machines is within reach of a state sponsored intelligence agency.

So, that's often it: at some point, the computation would be so expensive that you'd have to infer that only a nation state could have financed it.