More than 700 civilians were evacuated from the dusitD2 complex after a 20-hour, overnight siege that echoed a 2013 assault that killed 67 people in Nairobi's Westgate shopping center in the same neighborhood.
Some hid under desks as bullets shattered plate glass doors. Others jumped from windows, or ran out under fire.
Fifty people believed to have been in the complex remained unaccounted for by mid-afternoon on Wednesday, the Kenya Red Cross said, raising the prospect of a higher death toll even after President Uhuru Kenyatta declared the militants defeated.
"The security operation at dusit complex is over, and all the terrorists eliminated," Kenyatta told the nation in a televised address, looking drained and grave.
"As of this moment, we can confirm that 14 innocent lives were lost through the hands of these murderous terrorists."
Kenyatta did not specify how many assailants there were, but CCTV clips showed at least five dressed in black.
One is seen waiting outside the restaurant before blowing himself up in a cloud of debris just after 3 p.m. (1200 GMT) on Tuesday. Four others then shoot assault rifles crossing the car park.
The attack was claimed by Somali group al Shabaab, an al Qaeda affiliate fighting to topple the weak UN-backed government and impose strict Islamic law.
Air strikes against the group have stepped up under US President Donald Trump, but Tuesday's attack showed it retains ability to strike outside Somalia's borders.
Neighouring Kenya, a hub for expatriates, became a frequent target for al Shabaab after sending troops into Somalia to try to create a buffer zone along the long, porous border.
AMERICAN, BRITON AMONG DEAD
At least two groups of people were trapped throughout the night, with gunfire continuing as dawn broke.
Some sent text messages out begging for medical help.
Eleven Kenyans - including two best friends who worked to help Somalia - an American 9/11 survivor, and a British development professional were among the casualties.
Some victims had been dining in the Secret Garden restaurant and lay slumped at tables, photos seen by Reuters showed.
The complex is home to offices of international companies including Colgate Palmolive, Reckitt Benckiser, Pernod Ricard, Dow Chemical ad SAP, as well as the dusitD2 hotel, part of Thai group Dusit Thani .
Hiram Macharia, marketing executive at LG Electronics, grabbed a fire extinguisher and headed downstairs after the first blast.
"Then we saw two of the attackers firing at the elevators and we turned back," he told Reuters outside the hotel.
"They were firing twice at each of the elevator doors and the two staircase doors on each floor as they walked up the building. One of them fired at our office doors, entered slightly and then moved on."
Macharia and some colleagues hid under desks, but one person ran to the roof and was shot dead there, he added.
WESTGATE MISTAKES AVOIDED
Security forces appeared to have avoided the mistakes made during the 2013 attack, when police and soldiers shot at each other, then soldiers looted the Westgate mall.
"I thank ... the rescue operations commander ... the rest of the security forces for saving the hostages," tweeted former legislator Boni Khalwale, whose daughter was saved.
One private security professional at the scene said many of the explosions, especially those followed by a short burst of gunfire, were special forces using small charges to blow open locked doors and clear rooms.
Mamadou Dia was on a business trip from Paris for STP Consultants when he ended up huddled in a room with Chinese and Canadian hotel guests and a waiter.
He received updates on his telephone.
"They told us by text that the police knew we were in that room and that they would come, and one and a half hours later, the police came to evacuate us," he said.
As armed officers escorted them out, the attackers started shooting at them "like snipers," he said, adding police fired back.
Families at Chiromo morgue were told they could not view bodies until a forensic investigation had been performed, provoking grief and anger.
The family of a missing 35-year-old man collapsed upon hearing a body had arrived with his identification papers.
"He is gone, he is gone," the father repeated into his phone as his mother wrapped a shawl around herself and wept.
Another family arrived, demanding to see whether their relative was there but were told only police had access.As they argued, an elderly couple arrived in silence, bringing a freshly pressed suit to dress their dead son.