BN254 is y² = x³ + 3 over a 254-bit prime, from the family of pairing-friendly curves of Barreto and Naehrig (2005) with embedding degree 12. Its pairing maps G1 (points on this curve) and G2 (points on a twist over GF(p²)) into GF(p¹²), which is what zk-SNARK verifiers and aggregate signatures need.
Ethereum added precompiled contracts for addition, scalar multiplication and pairing checks on this curve in the Byzantium upgrade (EIP-196, EIP-197), and Groth16 and PLONK verifiers on Ethereum rely on these precompiles. Zcash's original Sprout circuits used it too.
Its security was estimated at 128 bits when it was chosen, but the extended tower number field sieve (Kim and Barbulescu, 2016) lowered the estimate to about 100 bits (Barbulescu and Duquesne, 2019). New designs use BLS12-381 instead.