BLS12-381 is the pairing-friendly curve of Ethereum's consensus layer, Zcash and Filecoin.
BLS12-381 is a short Weierstrass curve y² = x³ + ax + b over a 381-bit prime field with a 255-bit prime-order subgroup and cofactor 76329603384216526031706109802092473003; its estimated security level is 117 bits. Status: secure, but regional or niche.
BLS12-381 is a Barreto–Lynn–Scott curve with embedding degree 12, designed by Sean Bowe for Zcash in 2017. G1 is y² = x³ + 4 over a 381-bit prime, G2 lives on a twist over GF(p²), and both use a 255-bit prime-order subgroup. Its security is estimated at about 117–120 bits after the number field sieve improvements that weakened BN254.
Ethereum's proof-of-stake consensus signs attestations with BLS signatures on this curve (draft-irtf-cfrg-bls-signature), so thousands of signatures aggregate into one, and EIP-2537 adds precompiles for it to the execution layer. Zcash Sapling, Filecoin and the drand randomness beacon use it too.
G1's cofactor is large (h above), so implementations must check that received points lie in the prime-order subgroup before using them.