128 or 256?

Isn't that any integer between 0 and 2²⁵⁶ (or any 64 character number in hexadecimal format) can be turned into a valid private key?
I know the exact number is a little smaller due to secp256k1 ECDSA standard, but the number of valid private keys should be much bigger than 2¹²⁸.

What I am missing here?