Why do elliptic curves require fewer bits for the same security level?
The best algorithm for computing discrete logs in a well-chosen finite field $\mathbb Z/p\mathbb Z$, where the safe prime $p$ has no structure that can be exploited by the special number field sieve, is the general number field sieve, or GNFS for short.  The GNFS costs $L^{\sqrt[3]{64/9} + o(1)} \approx L^{1.92999 + o(1)}$ bit operations, where $L = e^{n^{1/3} (\log n)^{2/3}}$ and $n = \log p$.  If we treat the $o(1)$ term as zero, to raise this cost above $2^{128}$ we need to pick $n$ so that $$2^{128} \leq e^{1.92999 n^{1/3} (\log n)^{2/3}}.$$  Solving this in closed form is a pain involving the Lambert W product log function, but if we restrict our search to $1024 t$-bit primes $p$ so that $n \approx 1024 t \log 2$, we find the smallest bit size is $1024 t = 3072$.  If we allow merely raising the cost above $2^{112}$, we can make do with $1024 t = 2048$.

\begin{equation}
\begin{array}{cc}
\text{modulus bit size} &amp; \text{GNFS cost: $L^{1.92999}$} \\
\hline
1024 &amp; 2^{87} \\
2048 &amp; 2^{117} \\
3072 &amp; 2^{139} \\
4096 &amp; 2^{157}
\end{array}
\end{equation}

Caveat: There may be batch optimizations like there are in the NFS for factoring[1].  So these may be optimistic overestimates when the adversary has a large number of targets to attack simultaneously.  There are also other reasons—performance, storage costs, and side channel security—to prefer elliptic curve groups over finite fields, but that's a topic for another question.

In contrast, the best algorithm for computing discrete logs in a well-chosen elliptic curve group of order $\ell$ is essentially a generic algorithm for finding discrete logs in an arbitrary group, namely Pollard's $\rho$ algorithm, with merely small constant factor speedups for elliptic curves, and costs $\sqrt{\ell \pi/4}$ curve additions, which will require hundreds of bit operations apiece.

The square root cost means that if we want the cost of an attack to be $2^\lambda$ then we need to choose a group of prime order $(2^\lambda)^2 = 2^{2\lambda}$.  By Hasse's theorem, the order of the curve group over a coordinate field of order $q$ can't differ from $q$ by more than about $\sqrt q$, so we need to choose a curve over a finite field with about twice as many bits as we want bits of security $\lambda$.  Some curves like NIST P-224 are chosen to have groups of prime order, while others like Curve25519 are chosen to have groups of composite order $h \ell$ for small cofactor $h = 8$ and large prime $\ell$ so $\ell \approx q/h$.

\begin{equation}
\begin{array}{cccc}
\text{group} &amp; q &amp; {\approx}\ell &amp; \text{$\rho$ cost: $\sqrt{\ell \pi/4}$} \\
\hline
\text{NIST P-224} &amp; 2^{224} - 2^{96} + 1 &amp; 2^{224} &amp; 2^{111} \\
\text{Curve25519} &amp; 2^{255} - 19 &amp; 2^{252} &amp; 2^{125} \\
\text{edwards448} &amp; 2^{448} - 2^{224} - 1 &amp; 2^{445} &amp; 2^{222}
\end{array}
\end{equation}

In brief, there are much cheaper algorithms for computing discrete logs in the finite field $\mathbb Z/p\mathbb Z$ than for computing discrete logs in the elliptic curve $E(\mathbb F_q)$, so we need to choose $p$ much higher than $q$ for the same security.