where EVENT_NAME='AddedBlackList' and CONTRACT_ADDRESS='0xdac17f958d2ee523a2206206994597c13d831ec7'

and EVENT_INPUTS:_user not in (select EVENT_INPUTS:_user from ethereum.core.fact_event_logs

where EVENT_NAME='RemovedBlackList' and CONTRACT_ADDRESS='0xdac17f958d2ee523a2206206994597c13d831ec7')),

tb AS (select USER_ADDRESS,LAST_ACTIVITY_BLOCK_TIMESTAMP,CURRENT_BAL,SYMBOL,USD_VALUE_NOW

from ethereum.core.ez_current_balances where USER_ADDRESS in (select "banned address" from ban) and SYMBOL is not NULL and USD_VALUE_NOW is not NULL)

select

case when ADDRESS_NAME is not null then ADDRESS_NAME

else USER_ADDRESS end AS "banned address",

sum(case when SYMBOL='USDT' then CURRENT_BAL else 0 end) AS "USDT balance"

from tb left join ethereum.core.dim_labels on address=USER_ADDRESS

group by 1 having ("USDT balance">0)

order by 2 desc

limit 10