Five other attackers were killed by gunfire, he said.
"We have ashamed and defeated our attackers," Kenyatta said in the televised address to the nation.
He said 11 other suspects had been arrested; authorities had previously announced the arrest of seven at the airport and three elsewhere.
"These cowards will need justice as well their accomplices and patrons, wherever they are," Kenyatta said.
Kenyatta declared three days of national mourning starting Wednesday.
Kenyan forces had for more than two days said they were in the "final phase" of the operation, only to be battled back by the militants inside the building.
Explosions rang from the upscale Westgate mall in Nairobi throughout Tuesday, and the chatter of gunfire from inside the building could also be heard. Fresh smoke rose from the building in the afternoon.
The Kenyan Red Cross had previously said 62 people had been killed, and it seemed certain that the number of confirmed deaths would rise as security forces comb the building.
Nairobi's city morgue had already braced for the arrival of a large number of bodies of people killed, an official said.
Kenyan Red Cross spokesman Abbas Gullet said it was still not known how many more may be dead inside the building.
"It is certainly known that there are more casualties," he said.
A government official told The Associated Press that the morgue was preparing for up to an additional 60 bodies, though the official didn't know an exact count. The government official insisted on anonymity so he would not face retribution from government officials.
Earlier Tuesday the al-Qaida-linked attackers used social media to give accounts of the fighting inside the mall that conflicted with the government reports.
"There are countless number of dead bodies still scattered inside the mall, and the mujahideen are still holding their ground," the Somali rebel group al-Shabab said earlier in the day in a Twitter message considered to be genuine.
It added that the hostages are "still alive looking quite disconcerted but, nevertheless, alive."
But there were no tweets from the al-Shabab account immediately after Kenyatta's address.
Al-Shabab, whose name means "The Youth" in Arabic, said the mall attack was in retribution for Kenyan forces' 2011 push into neighboring Somalia. African Union forces pushed the al-Qaida-affiliated group out of Somalia's capital in 2011.
"You could have avoided all this and lived your lives with relative safety," the group Tweeted Tuesday. "Remove your forces from our country and peace will come."
Kenyatta said "initial reports had suggested that a British woman and two or three American citizens may have been involved in the attack," but that "we cannot confirm the details at the moment.
He said experts were working to try and determine the nationalities of the terrorists.
A security expert with contacts inside the mall described the attackers as "a multinational collection from all over the world."