There's the metadata on the leaked files indicating that at least the metadata was modified with a cyrillic computer. There's reports from two separate security firms implicating the same two Russian based actors. There's the fact that "Guccifier 2.0" had no online presence until after the the Crowdstrike report implicating Russian intelligence services. There's the fact that "Guccifier 2.0" claims to Romanian, but can't type fluent Romanian (I've heard this independently from a Romanian I know), and drops smilies typical in Russian forums, but not Romanian.
None of this is fire, but there's plenty of smoke.
[0] https://www.wired.com/2016/07/heres-know-russia-dnc-hack/
https://medium.com/@jeffreycarr/can-facts-slow-the-dnc-breac...
The IP-address (176.31.112.10) that links the DNC hack to the Bundestag hack is a machine in France (appearantly) controlled by a Pakistani hosting company. This article says the machine was closed because of abuse over a year ago. The material in the DNC hack is just one month old:
https://netzpolitik.org/2015/digital-attack-on-german-parlia...