The victims, identified as two European tourists in their 20s, were swimming at Kylies Beach in Crowdy Bay National Park when the incident occurred.
A forensic assessment by shark scientists concluded that a large bull shark was likely involved in the attack.
Bystanders provided immediate aid, with one using clothing to fashion a tourniquet for the man, who was later flown to hospital in a critical but now stable condition.
Authorities have closed Kylies Beach and neighbouring areas, deploying SMART drumlines, while experts noted the rarity of a single shark attacking two people.