The number of those killed at the DusitD2 complex rose with the discovery of six more bodies at the scene and the death of a wounded police officer, said Joseph Boinnet, inspector-general of Kenyan police. Twenty-eight people were hurt and taken to the hospital, he said.
In a televised address to the nation earlier in the day, President Uhuru Kenyatta announced that the all-night operation by security forces to retake the complex was over and that all of the extremists had been killed.
"We will seek out every person that was involved in the funding, planning and execution of this heinous act," he vowed.
In an attack that demonstrated al-Shabab's continued ability to strike Kenya's capital despite setbacks on the battlefield, extremists stormed the place with guns and explosives. Security camera footage released to local media showed a suicide bomber blowing himself up in a grassy area in the complex, the flash visible along with smoke billowing from the spot where he had been standing.
Of the civilian victims, 16 were Kenyan, one was British, one was American and three were of African descent but their nationalities were not yet identified, police said.
Al-Shabab, which is based in neighboring Somalia and allied with al-Qaida, claimed responsibility. The Islamic extremist group also carried out the 2013 attack at Nairobi's nearby Westgate Mall that killed 67 people, and an assault on Kenya's Garissa University in 2015 that claimed 147 lives, mostly students.
While U.S. airstrikes and African Union forces in Somalia have degraded the group's ability to operate, it is still capable of carrying out spectacular acts of violence in retaliation for the Kenyan military's campaign against it.
The bloodshed in Kenya's capital appeared designed to inflict maximum damage to the country's image of stability and its tourism industry, an important source of revenue.
The government said late Tuesday that buildings were secure. However, gunfire continued into Wednesday morning, and dozens of trapped people were rescued overnight. Several loud booms were heard Wednesday as teams sought to clear the complex of booby traps and other explosives.
Kenyatta's announcement that the security operation was complete came about 20 hours after the first reports of the attack.
The Kenyan Red Cross said about 50 people were unaccounted for. But many of those were believed not to have been in the complex during the attack.
Ken Njoroge, CEO of a company in the DustiD2 complex that offers mobile banking services, said he was unable to locate several employees. "It's very difficult for the families because the passage of time only makes the problem bigger," he said.
The American killed in the attack was identified as Jason Spindler, co-founder and managing director of San Francisco-based I-DEV International. Spindler's father, Joseph, said his son worked with international companies to form business partnerships in Kenya that would boost local economies.
The Houston-raised Spindler had a brush with tragedy on 9/11: He was employed by a financial firm at the World Trade Center at the time of the 2001 terrorist attack but was running late that morning and was emerging from the subway when the first tower fell, according to his father. He became covered in dust and debris as he tried to help others, the elder Spindler said.
In the Nairobi attack, a man who gave only his first name, Davis, described how he had escaped with colleagues by fleeing down a fire escape.
"It's a traumatic experience. It shakes you," he said. Still, Davis said he was impressed by the "inner strength" and compassion of people who helped each other in the midst of danger.
His own thoughts, he said, were: "Get people out and get out yourself. That's it."