So I made quite a lot of research about this and couldn't find the answer.
Does it use a named pipe ? a socket on localhost ? d-bus ?
Can I intercept and see the binary messages sent by an X client to the X server with a line of bash ?
Of course this is only for educational purpose. I don't intend to build a software that would intercept such messages.
It uses a Unix domain socket, of the name /tmp/.X11-unix/X${DISPLAYNUMBER}. These days Linux support a special naming for Unix domain sockets, called "abstract namespace UDS", where the path is prepended with an @, but is otherwise the same.