It was definitely for the banking trojan he created and sold, that would later become Kronos. That said, he also became sort of a public figure in the field due to stopping the initial strain of Wannacry, so news articles were popping up talking about how he was at least tangentially related to Wannacry, and was recently arrested for malware charges. People saw that and started drawing the false conclusion that he created Wannacry.

AFAIK, they arrested him because of the creation and sale/distribution of the Kronos and "UPAS Kit" malware [1].

[1]: https://www.justice.gov/usao-edwi/pr/marcus-hutchins-pleads-...

> for a long time it seemed that they were kangaroo-accusing him of somehow being responsible for wannacry because he registered the domain it pointed to.

That certainly wasn't a long time. As far as I remember it was very shortly after his arrest (maybe a day or so) when it became public that it was for the Kronos malware and unrelated to the wannacry incident.