The grenade was live but did not explode.
The White House, which initially said Bush was never in danger, said the incident on 10 May in Georgia's capital has led to a review of security at presidential events.
FBI agents are still investigating in Tbilisi, where tens of thousands of people heard Bush speak in strong support of Georgia's efforts at democratic development.
It is unclear how much danger Bush faced.
According to the FBI's initial investigation, the grenade failed to explode because of a malfunction. The activation device deployed too slowly to hit the blasting cap hard enough, agent Bryan Paarmann said.
The grenade was a knockoff of a Soviet-designed RGD-5, a fragmentation grenade with a lethal range of about 31m, according to a source familiar with the incident, who spoke on condition of anonymity.
"We consider this act to be a threat against the health and welfare of both the president of the United States and the president of Georgia as well as the multitude of Georgian people that had turned out at this event," Paarmann said.
No one in the US delegation - Bush, his staff, members of the media that accompanied him and others - saw a grenade being tossed. There was no sign anything was amiss during the president's half-hour appearance in Freedom Square.
Bush spoke from an armoured podium on a stage shielded by bullet-proof glass on the sides; there was no bullet-proof shield across much of the stage's front.
"We consider this act to be a threat against the health and welfare of both the president of the United States and the president of Georgia as well as the multitude of Georgian people that had turned out at this event"
US officials are trying to determine whether the grenade was thrown with the intention of doing harm or was placed in the crowd for other reasons.
"There are a lot of security measures that the Secret Service takes," White House spokesman Scott McClellan said. "The Secret Service has the full trust of the president."
The grenade's discovery has led to questions about the adequacy of the extensive security measures used to protect Bush.
The number of metal detectors set up by the Secret Service, based on predictions by Georgian authorities, proved far too few.
The crowd was one of the largest Bush has addressed.
After three hours, authorities were overwhelmed by the number of people and let many go around the detectors.
"The Secret Service is looking into all those issues," McClellan said.
Georgian officials have suggested the device may have been planted to undermine the upbeat relations on display between Bush and Georgia's new West-leaning president, Mikhail Saakashvili.
Officials: The grenade could have
damaged US-Georgia relations
The small nation has a large cast of potential culprits, including former government elites angry at Saakashvili's anti-corruption crackdown, supporters of two separatist regions aligned with Moscow, terrorists from the Pankisi Gorge and Russian saboteurs.
A law enforcement official said there are not any suspects or any claims of responsibility. A reward of about $11,000 was offered for information about those responsible.
The grenade was wrapped in a dark plaid cloth. It was "tossed in the general direction of the main stage" about 1.30pm, right after Bush began speaking, and landed less than 31m from the podium, Paarmann said.
After bouncing off a child's cap, the grenade was removed by a Georgian security officer.
Bush knew nothing about the grenade until he had left the country. Georgian authorities did not tell the president's security detail until after his plane had left for Washington.
At first, the White House said the president was never in danger. Georgian officials denied the incident had happened.
A day later, Georgian officials confirmed there had been a grenade but said it was found on the ground - not thrown, as the Secret Service had said. They also said it was an "engineering grenade" - which is not designed to spread shrapnel - and was found in inactive mode.
"Obviously we've learned more since," McClellan said.