The only problem is there is no way to prove that that address actually belongs to the GRU.
They don't have to. This case isn't going to trial; it was basically a PR stunt. It wouldn't survive a trial. The strategy is simple: Indict a bunch of people that you cannot extradite, and you get a PR win with just some broad strokes and have to prove nothing. You get to keep your unlimited budget to continue the investigation, and the press keeps listening to you.