Complexity of number field sieve theorem does not match with security of elliptic curves
But in many places I saw that BN256 curve provided 128 bit security. Where I am doing wrong?


There are two potential attacks against the DLog problem in BN256


The first is to attack the DLog problem in the finite field; that is, given the points $G$ and $H$, we compute $e(G, G)$ and $e(G, H)$, and then find the value $x$ with $e(G, G)^x = e(G, H)$.
The other is to attack the DLog problem in the elliptic curve itself; that is, given the points $G$ and $H$, you use Pollards Rho (or Big-Step-Little-Step) to directly solve $xG = H$ (ignoring the pairing operation entirely).


As BN256 is a 256 bit curve, we know that the cost of the second approach is no more than an expected $2^{128}$ point additions, hence the security of the curve can be no more than 128 bits.