Militant Islamist group Islamic State claimed responsibility for Friday's rampage but there were indications that Russia was pursuing a Ukrainian link, despite emphatic denials from Ukrainian officials that Kyiv had anything to do with it.
Moscow regional governor Andrei Vorobyov said 133 bodies had been recovered from the rubble in 24 hours, and doctors were "fighting for the lives of 107 people." State TV editor Margarita Simonyan, without citing a source, had earlier given a toll of 143.
In a televised address, Putin said 11 people had been detained, including the four gunmen. "They tried to hide and moved towards Ukraine, where, according to preliminary data, a window was prepared for them on the Ukrainian side to cross the state border," he said.
Russia's FSB security service said the gunmen had contacts in Ukraine and were captured near the border. It said they were being transferred to Moscow.
Putin cast the enemy as "international terrorism" and said he was ready to work with any state that wanted to defeat it.
"All the perpetrators, organisers and those who ordered this crime will be justly and inevitably punished. Whoever they are, whoever is guiding them," Putin said.
"We will identify and punish everyone who stands behind the terrorists, who prepared this atrocity, this strike against Russia, against our people."