Number field sieve algorithm can is used to break discrete logarithm on field $F_{p^n}$. The algorithm has time complexity $\exp((c+o(1))\cdot(\log p^n)^{1/3}\cdot(\log \log p^n)^{2/3}$. Originally the constant $c$ is $(64/9)^{1/3} = 1.92$. Due to recent works, the more advanced Special extended tower number field sieve algorithm has $c = (32/9)^{1/3} = 1.54$.
Using this I tried to estimate the security of pairing-based elliptic curves. Consider BN256 curve. The pairing based elliptic curve has embedding degree 12. This means, the discrete log on BN256 can be mapped to discrete log on $F_{p^{12}}$, where $p$ is 256 bit prime. Now, on calculating the complexity of original NFS algorithm on $F_{p^{12}}$, we get roughly $$\exp(1.92 * (12*256)^{1/3} * (\log_2 (12*256))^{2/3}) = \exp(142.9) = 2^{206.16}$$ by wolframalpha (I ignored o(1) term for simplicity). So, BN256 curve originally provided 206 bit security. But in many places I saw that BN256 curve provided 128 bit security. Where I am doing wrong?
Edit: By @Poncho's answer, BN256 curve can be attacked better by pollard's rho algorithm. That justifies why BN256 is claimed to have 128 bit security earlier. After the recent Tower NFS algorithm, BN256 is claimed to have less than 110 bit security (Table in this blog). But when I calculate by wolframalpha, $$\exp(1.54 * (12*256)^{1/3} * (\log_2 (12*256))^{2/3}) = \exp(114.6) = 2^{165}$$. Therefore, even now, BN256 curve should have 128 bit security right?